OFICIAL GitLab Blog

GitLab 19.4 released

What happened
Based on GitLab Blog · Sep 18, 2026

GitLab 19.4 introduces governance controls for AI agents, expanded language support in SAST, and new CLI and Slack integrations for GitLab Duo.

🚩 Report a correction ↗ Open source
Key points
·
Jimmy, a Level 4 contributor, recognized as Notable Contributor for contributions to tokens, service accounts, and push mirrors via infrastructure as code.
·
Advanced SAST in GitLab 19.4 now scans Kotlin, Dart, and Scala with deep taint analysis, verified using deliberately vulnerable repositories.
·
GitLab Duo CLI’s /goal slash command delegates open-ended objectives to a governed flow with independent verification and user control.
Key numbers
·
4 now supports SPDX expressions, including compound declarations such as MIT OR Apache-2.
·
0 or GPL-2.
·
0-only WITH Classpath-exception-2.

GitLab 19.4, released on September 17, 2026, introduces governance controls for AI agents operating within the GitLab Duo Agent Platform. Previously limited to internal tools, administrators can now apply rules to third-party agents via the GitLab MCP server, ensuring consistent governance across all tools. These settings are accessible in group and project GitLab Duo configurations, where modes can be set for each tool to restrict access to approved MCP tools. The feature, currently in beta, allows users to define boundaries for AI agent activities, sessions, and tasks.

The update enhances vulnerability triage with the Vulnerability Context Flow, enabling more efficient and intelligent prioritization of security findings. Advanced SAST scanning now supports Kotlin, Dart, and Scala with deep taint analysis, matching the capabilities previously available for Java and Python. These scans are delivered through the Software Factory architecture and verified using deliberately vulnerable repositories, with findings presented as code flows from source to sink.

License management in GitLab 19.4 now supports SPDX expressions, including compound declarations such as MIT OR Apache-2.0 or GPL-2.0-only WITH Classpath-exception-2.0. Previously reported as unknown, these expressions now appear in the dependency list with their operators (AND, OR, WITH) and can be evaluated by license approval policies. Expressions declared in CycloneDX SBOMs are now synchronized into GitLab’s license data, with offline instances receiving updates after downloading v3 license data.

GitLab Duo CLI introduces a /goal slash command that delegates open-ended objectives to a governed, goal-driven flow running locally. Users describe a goal, and GitLab Duo handles implementation and verification, using an independent judge to assess progress. The command requires GitLab 19.3 or later and GitLab Duo CLI 9.17.0 or later. Additionally, the GitLab Duo Slack integration allows users to invoke agent flows directly from Slack by mentioning @GitLab, enabling codebase queries and issue creation without switching interfaces.

Original source → Deals on Clipraptor.com →