PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

When a version bump breaks your build, GitLab fixes it

about.gitlab.com | blog | #ai-security | #supply-chain | #gitlab | #devsecops | #remediation | #dependency-management | #security | #dependency-scanning | #auto-remediation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

GitLab's Dependency Scanning Auto-Remediation enters beta: when a scan flags a vulnerable package, it opens a merge request, uses AI to fix breaking changes, and iterates until the pipeline passes.
Published
Collected

Related coverage

vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
blog · about.gitlab.com
What happens when vulnerabilities are discovered faster than you can fix them?
AI is changing how quickly vulnerabilities can be discovered and exploited. The next challenge is bringing that same speed to remediation and prevention
blog · about.gitlab.com
Extend GitLab Duo Agent Platform into your business systems
Learn how to call a custom GitLab flow from Salesforce so every error arrives as a GitLab issue with root-cause analysis, ready to fix and deploy.
blog · about.gitlab.com
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
blog · about.gitlab.com
Building AI security in the open
GitLab has joined the Open Secure AI Alliance to help advance transparent, adaptable approaches to securing AI systems.
blog · about.gitlab.com
Unblock agentic software delivery with governed code review
Client-side review helps the author move faster. Repo-side review on Duo Agent Platform certifies every merge request against rules you set once, at a flat $0.25 rate per review.
Back