GitLab 19.5 was released on October 15, 2026. The GitLab MCP server and GitLab Secrets Manager are now generally available, and the MCP server gives external agents such as Claude Code and Cursor access to a wider set of GitLab tools. The release also adds beta support for connecting externally connected agents to AI Governance, plus non-default branch vulnerability tracking and several GitLab Duo CLI features.
platform teams Platform teams can scope CI secrets per job by environment and branch and get audit logs for each secret operation, using existing GitLab permissions. Security teams can see sessions from agents running outside GitLab, with audit events sent to a SIEM, though this ECA capability is in beta.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Secrets Manager: Govern secrets like your code
GitLab says Secrets Manager is now generally available in GitLab 19.5 for Premium and Ultimate on GitLab.com and Self-Managed, with GitLab Dedicated coming soon. It is built on OpenBao and stores build-time and runtime credentials under GitLab's project and group permissions and audit trail. Jobs receive only the secrets they declare and that match branch and environment scope conditions.
platform teams Platform teams can replace raw CI/CD variables with scoped secret references and serve Kubernetes via External Secrets Operator, Terraform and OpenTofu data sources, and the Vault-compatible API from one store. Pricing is a paid add-on billed in GitLab Credits, and the source notes a CI/CD variable migration workflow is still in development.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Get every merge request in front of the right reviewer, faster
GitLab 19.5 makes Recommend Reviewers Flow generally available on GitLab.com, Self-Managed and Dedicated. When a merge request is created, the flow suggests one reviewer based on workload, time zone, availability and expertise defined by approval rules and CODEOWNERS, and shows its reasoning. Authors can assign the suggested reviewer with one click. The vendor also states that Code Review Flow costs a flat 0.25 GitLab Credits per review and cuts per-review cost by 99% against a manual review estimate.
platform teams Platform teams using GitLab can enable the flow as a project trigger and rely on CODEOWNERS and approval rules as the input for reviewer routing. The benefit to review load and time to first review is the vendor's claim and no independent data is given.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Connect your agents to your software lifecycle with the GitLab MCP server
GitLab announced general availability of its MCP server with GitLab 19.5, letting MCP-compatible agents work with code, merge requests, work items and pipelines. The release adds tools for branches, file reads, semantic code search, pipeline inspection and artifact reads, and consolidates related tools into fewer calls. Agents can also start and follow GitLab Duo Agent Platform flows, with actions running under existing GitLab permissions.
platform teams Platform teams evaluating agent access to GitLab can connect external agents with permissions inherited from GitLab, and can limit the tool surface with toolsets. The source gives no measured figures for the claimed reduction in calls or context.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Adds Goal-Driven Agents and Tighter Cost Controls
GitLab released version 19.4 of its DevSecOps platform. The release adds a goal-driven mode to GitLab Duo CLI, three hosted open-weight models, a larger set of Model Context Protocol tools, and more detailed controls for AI spending.
platform teams Platform teams running GitLab can now set AI spending controls and use a broader MCP tool set when agents consume GitLab APIs. The source text does not give details on the controls or tool permissions, so the specifics need checking in the release notes.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Track organization-wide security risk in one dashboard
GitLab 19.4 adds an organization-level security dashboard in beta for GitLab.com Ultimate users. It shows a risk score calculated from severity and age of open vulnerabilities, KEV status, and EPSS scores, with trend, age, severity and CWE charts across all top-level groups. Third-party scanners that output SARIF can also feed findings into the same view.
platform teams Platform and security teams running GitLab across multiple top-level groups can get a single rolled-up vulnerability view without manual reporting, provided they have an Organization with Owner access and at least one scanner with a completed default-branch scan. The feature is beta and limited to GitLab.com.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
Dependency Firewall: Block risky packages before the build
GitLab announced Dependency Firewall, now in early access for GitLab.com and GitLab Self-Managed Premium and Ultimate customers. It blocks or warns on packages that match a policy covering malware status, vulnerability severity, license type, and minimum package age, before they are installed in a build. The source also cites five malicious PyPI packages GitLab researchers found in June 2026, four of them typosquats of Flask, Requests, and NumPy.
platform teams Platform teams can set policy once at the top-level group, with project-level overrides where the strictest rule applies, and run warn mode before switching to block mode with logged bypasses. Teams using Sonatype Nexus or JFrog Artifactory can apply it at the registry, and the GitLab CLI can check a package before it is added.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
What's new in Git 2.56.0?
Git 2.56.0 adds a drop subcommand to git-history that removes a commit and rebases its descendants onto its parent, and new --forked and --delete-merged options to git-branch for finding and deleting branches merged into an upstream. It also lets git-refs create, delete, update and rename refs, and adds a remote-object-info command to git-cat-file and a --drop-filtered option to git-repack for partial clones. The post also outlines a plan where Git 2.98 follows 2.56, with 2.99 and 3.0 shipping together in spring 2027 and 3.0 making SHA-256 the default object format, reftable the default ref storage, and Rust mandatory.
platform teams Platform teams running Git-based pipelines get new commands for cleaning up merged branches and reclaiming disk space in partial clones, but nothing in this release changes existing CI behavior. The Git 3.0 plan (SHA-256 default, reftable default, Rust required) is a future breaking change that teams should check their forges, tooling and build toolchains against, and the 2.99 LTS release is aimed at platforms without a Rust toolchain.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
New MCP tools help platform teams scale automation
GitLab 19.4 substantially expands the GitLab MCP server tool set with CI/CD, merge request, work item, vulnerability and project tools, currently in beta. Read-only actions run without a human in the loop by default, while writing, merging or deleting actions wait for a reviewer the team chose. A new Merge request created trigger lets a flow or external agent run when an MR is opened once the diff is generated.
platform teams Platform teams can let agents retry pipelines, read job logs, open and update MRs, and merge when checks pass, with approval gates set per action. Vulnerability tools require the Ultimate tier, and the MR created trigger requires Premium or Ultimate with GitLab Duo Agent Platform enabled.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
v1.55.02026-09-15minorsecurity++++++++++++++++!!sharesource Backstage v1.55.0
Backstage v1.55.0 was released with 53 changes, seven of which are security fixes across several auth, catalog, proxy, scaffolder and TechDocs backend packages. The other changes are mostly fixes and additions, including new GitLab and GitHub scaffolder actions, a scaffolder task worker fix, and a default MCP server that is now always exposed at /api/mcp-actions/v1.
platform teams Platform teams running Backstage should plan to upgrade to pick up the security fixes in the auth, proxy and scaffolder packages. Teams using the MCP actions endpoint or the GitLab scaffolder actions should check the changed behavior before upgrading.
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules
- !@backstage/plugin-auth-backend-module-cloudflare-access-providersecurity
- !@backstage/plugin-auth-backend-module-oidc-providersecurity
- !@backstage/plugin-auth-nodesecurity
- !@backstage/plugin-catalog-backend-module-bitbucket-serversecurity
- !@backstage/plugin-proxy-backendsecurity
- !@backstage/plugin-scaffolder-backend-module-sentrysecurity
- !@backstage/plugin-techdocs-nodesecurity
- +The FixDialog, ContainerCard, and PodLogs components in @backstage/plugin-kubernetes-react no longer accept an implicit children prop, aligning with ADR006. Contributed by @suletetes in #35154.added
- +Fixed the owner selected in the catalog import stepper being written to the generated catalog-info.yaml as a display name instead of an entity reference. Contributed by @MFA-G in #35235.added
- +Fixed EntityOwnerPicker crashing with missing or empty kind errors when the owners query parameter contains humanized entity refs. Contributed by @mythrilium in #35270.added
- +Fixed CopyTextButton showing its tooltip on hover/focus instead of only after clicking. Contributed by @reachsanjivbhagat-gif in #34920.added
- +Added an optional variant prop to CopyTextButton for configuring its visual style. Contributed by @victoriacheng15 in #35567.added
41 more lines
- +Added an onCopyLog prop to the LogViewer component that renders a copy button in the toolbar. Contributed by @tobiasp284 in #35006.added
- +Added support for rendering custom link elements inside HeaderIconLinkRow.added
- +Fixed app.extensions shorthand and disabled field to accept boolean-ish strings so environment variable substitution can toggle extensions. Contributed by @tanaysingh2512 in #35261.added
- +Fixed a bug where overriding a plugin extension with withOverrides moved the overridden extension to the end of the plugin's extension list. Contributed by @gustavolira in #35613.added
- +Fixed a bug where plugin packages installed through feature discovery were loaded before the app's own code ran. Contributed by @kuangp in #35053.added
- +The default MCP server at /api/mcp-actions/v1 is now always exposed even when named servers are configured. Contributed by @majdsalman2 in #35383.added
- +Added an unread notifications home page card and new frontend system home widget. Contributed by @ciiay in #34869.added
- +The gitlab:issues:create action now accepts a full project path for projectId, and projectId is optional. Contributed by @kersten in #34544.added
- +Added an autoMerge boolean input to publish:gitlab:merge-request. Contributed by @PG2000 in #34947.added
- +Fixed gitlab:repo:push failing with a 400 error when the workspace has no file changes to commit. Contributed by @Naga15 in #34480.added
- +Fixed GitlabDiscoveryEntityProvider to only process push events targeting the configured branch. Contributed by @iamEAP in #35255.added
- +The GitHub multi-org entity provider now logs a clear warning when no GitHub App installation is found for an org. Contributed by @Dasmat13 in #34833.added
- +Fixed the scaffolder task worker silently giving up after a transient failure, where a single error while picking up a task would stop the backend from running any further templates. Contributed by @Mahanmmi in #35359.added
- +The workspace:template* actions are now exported by default. Contributed by @mbenson in #34915.added
- +Restored support for intrinsic string, number, array, Map, and Set methods in software templates.added
- +Software template inline conditionals without an else branch now render an empty string when their condition is false, matching Nunjucks behavior.added
- +Fixed a connection leak in the scaffolder event stream where unsubscribing did not abort the underlying SSE connection. Contributed by @carlerikjohan in #35401.added
- +Fixed several issues with scaffolder task event stream reconnection. Contributed by @carlerikjohan in #35401.added
- +Fixed the scaffolder wizard not scrolling to the top on step change in the new frontend system. Contributed by @sohailriyas01 in #35318.added
- +The catalog:query-catalog-entities action now accepts limit and offset as strings, coercing them to numbers before validation. Contributed by @anshgoyalevil in #34954.added
- +Fixed AwsS3UrlReader and AwsCodeCommitUrlReader to resolve account-specific AWS credentials when an assume role ARN is configured. Contributed by @beatleboy501 in #34938.added
- +Added optional accountId config to search.elasticsearch for resolving account-specific AWS credentials. Contributed by @beatleboy501 in #34938.added
- +Fixed Bitbucket Server file operations failing when the branch name contains special characters. Contributed by @suletetes in #35638.added
- +Fixed reading a duration from configuration so that an all-zero ISO 8601 duration yields a consistent zero value. Contributed by @suletetes in #35542.added
- +Fixed catalog model relations to inherit the source entity namespace when no default namespace is configured.added
- +Fixed a bug where catalog entities could fail to process when catalog model sources mix backstage.io/v1alpha1 and backstage.io/v1beta1 for the same kind. Contributed by @GabDug in #34552.added
- +Fixed WebSocket upgrade error responses in the signals backend to prevent load balancers from returning 502 on auth failures. Contributed by @jlawrie in #34761.added
- +Fixed accumulating abort listeners on MicrosoftGraphClient. Contributed by @csuich2 in #35321.added
- +Fixed CardExtension to avoid requiring app context when a custom Renderer is provided. Contributed by @ciiay in #34869.added
- +Fixed AWS S3 publishing to paginate existing objects to properly remove all stale TechDocs files. Contributed by @alecjacobs5401 in #35391.added
- +Fixed local TechDocs generation when temporary source paths resolve through filesystem aliases.added
- +Use the catalog presentation API for TechDocs document titles and owner labels. Contributed by @AarishMansur in #34760.added
- +Fixed techdocs-cli serve silently stopping live reload detection with click 8.3.x. Contributed by @GabDug in #35160.added
- +Fixed home clock configuration handling. Contributed by @NithinU2802 in #35192.added
- +Fixed ownership card catalog links to filter by stable entity references instead of display titles.added
- +Added resolveNotificationLink utility for resolving relative notification links to absolute URLs. Contributed by @gaelgoth in #33845.added
- +Added support for calling Connections find without authMethods. Contributed by @neoreddog in #35253.added
- +The JSON Schema exported for filter predicates can now be compiled by RE2-based validators. Contributed by @rhart in #35631.added
- +Added Kubernetes actions to get clusters and entity resources. Contributed by @drodil in #33832.added
- +Increased the test database cleanup timeout to 60 seconds. Contributed by @mtlewis in #35607.added
- +Significantly improved the performance of build-workspace when packaging many Backstage packages.added
53 lines7 security46 addedtyped from the source notes
38 older releases
| 19.1 | 2026-06-18 | minor | no itemized notes |
| 19.0 | 2026-05-21 | major | no itemized notes |
| 18.11 | 2026-04-16 | minor | no itemized notes |
| 18.10 | 2026-03-19 | minor | no itemized notes |
| 18.9 | 2026-02-19 | minor | no itemized notes |
| 18.8 | 2026-01-15 | minor | no itemized notes |
| 18.7 | 2025-12-18 | minor | no itemized notes |
| 18.6 | 2025-11-20 | minor | no itemized notes |
| 18.5 | 2025-10-16 | minor | no itemized notes |
| 18.4 | 2025-09-18 | minor | no itemized notes |
| 18.3 | 2025-08-21 | minor | no itemized notes |
| 18.2 | 2025-07-17 | minor | no itemized notes |
| 18.1 | 2025-06-19 | minor | no itemized notes |
| 18.0 | 2025-05-15 | major | no itemized notes |
| 17.11 | 2025-04-17 | minor | no itemized notes |
| 17.10 | 2025-03-20 | minor | no itemized notes |
| 17.9 | 2025-02-20 | minor | no itemized notes |
| 17.8 | 2025-01-16 | minor | no itemized notes |
| 17.7 | 2024-12-19 | minor | no itemized notes |
| 17.6 | 2024-11-21 | minor | no itemized notes |
| 17.5 | 2024-10-17 | minor | no itemized notes |
| 17.4 | 2024-09-19 | minor | no itemized notes |
| 17.3 | 2024-08-15 | minor | no itemized notes |
| 17.2 | 2024-07-18 | minor | no itemized notes |
| 17.1 | 2024-06-20 | minor | no itemized notes |
| 17.0 | 2024-05-16 | major | no itemized notes |
| 16.11 | 2024-04-18 | minor | no itemized notes |
| 16.10 | 2024-03-21 | minor | no itemized notes |
| 16.9 | 2024-02-15 | minor | no itemized notes |
| 16.8 | 2024-01-18 | minor | no itemized notes |
| 16.7 | 2023-12-21 | minor | no itemized notes |
| 16.6 | 2023-11-16 | minor | no itemized notes |
| 16.5 | 2023-10-22 | minor | no itemized notes |
| 16.4 | 2023-09-22 | minor | no itemized notes |
| 16.3 | 2023-08-22 | minor | no itemized notes |
| 16.2 | 2023-07-22 | minor | no itemized notes |
| 16.1 | 2023-06-22 | minor | no itemized notes |
| 16.0 | 2023-05-22 | major | no itemized notes |