Summary
GitLab 19.2, released July 16, 2026, brought governed agentic automation to DevSecOps: Dependency Scanning Auto-Remediation (public beta) opens a merge request with a suggested fix when a scan finds a vulnerable package and iterates if the upgrade breaks the build, while a new Security Review Flow (public beta) catches business-logic and race-condition flaws that pattern scanners miss.
What changed
GitLab 19.2 added Dependency Scanning Auto-Remediation (public beta), which opens and iterates a fix merge request for vulnerable packages, plus a Security Review Flow (public beta) for logic-level flaws, GitLab Duo CLI (GA), and Custom Flows (GA).
Why it matters
As AI coding inflates the volume of code and dependencies, agents that close vulnerabilities via iterating merge requests move security from a growing backlog to an automated pipeline step. Governed agentic remediation inside the SCM directly targets the DevSecOps backlog that AI-generated code creates.
Evidence excerpt
GitLab 19.2 (July 16, 2026): Dependency Scanning Auto-Remediation opens a merge request with a suggested fix when a scan finds a vulnerable package and iterates if the upgrade breaks the build; Security Review Flow catches business-logic errors and race conditions.