---
title: "GitLab 19.2 brings agents to dependency fixes and code review"
description: "The July 16 release makes terminal assistance and Custom Flows generally available, with two security capabilities entering public beta."
url: https://kurddevelopers.com/en/news/gitlab-19-2-agentic-security-cli-july-2026
language: en # English
type: news
published: 2026-07-16T20:00:00.000Z
updated: 2026-11-03T12:22:46.000Z
author: "Osamah Ismail"
author_url: https://kurddevelopers.com/en/author/1
section: "Programming"
tags: ["GitLab","GitLab 19.2","DevSecOps","Duo CLI","AI Coding"]
sources: ["GitLab — 19.2 release","16 July 2026: https://about.gitlab.com/press/releases/2026-07-16-gitlab-19-2-brings-governed-agentic-automation/","GitLab — dependency remediation: https://about.gitlab.com/blog/dependency-scanning-auto-remediation/","GitLab — Security Review Flow: https://about.gitlab.com/blog/gitlab-duo-security-review-flow/","GitLab — Duo CLI: https://about.gitlab.com/blog/gitlab-duo-cli-generally-available/"]
image: https://kurddevelopers.com/uploads/2026/11/t3gez0gpayfndrhncunf-0947c325.png
translations:
  ku: https://kurddevelopers.com/news/gitlab-19-2-agentic-security-cli-july-2026
  ar: https://kurddevelopers.com/ar/news/gitlab-19-2-agentic-security-cli-july-2026
publisher: Kurd Developers
publisher_url: https://kurddevelopers.com/
---

# GitLab 19.2 brings agents to dependency fixes and code review

> The July 16 release makes terminal assistance and Custom Flows generally available, with two security capabilities entering public beta.

![Official GitLab Duo CLI artwork — GitLab.](https://kurddevelopers.com/uploads/2026/11/t3gez0gpayfndrhncunf-0947c325.png)

GitLab released version 19.2 on July 16, 2026, focusing on work beyond generating code: maintaining dependencies, reviewing changes and dealing with failing pipelines.

## Different features, different stages

| Feature | Announced status |
|---|---|
| Dependency Scanning Auto-Remediation | Public beta |
| Security Review Flow | Public beta |
| GitLab Duo CLI | Generally available |
| Custom Flows | Generally available |

Those distinctions matter when evaluating the release. Four features appearing in one announcement does not place them at the same development or availability stage.

## From an affected dependency to a merge request

GitLab says Auto-Remediation opens a merge request to update a package when scanning identifies an affected dependency. If the upgrade breaks the build, an agent attempts the necessary adaptations within that request.

Changes pass through the project’s existing approval requirements. For a team, that brings the proposal into its normal code-review location, with a record of what changed.

The useful output to assess is the resulting request: does it explain the upgrade, can the accompanying modifications be understood, and do the test results provide the reviewer with relevant evidence?

## Reviewing application logic

GitLab describes Security Review Flow as examining problems such as authorisation gaps and business-logic errors. Those concerns go beyond syntactically valid code.

For illustration, an API could execute an operation correctly while failing to check that the user owns the record being changed. The question is who may access or modify the resource. This is an explanatory example, not a finding from our testing of the tool.

That perspective helps explain the intended work: reviewing a change in the context of the application’s purpose rather than considering only individual lines.

## Work from the terminal

Duo CLI brings agent assistance into the terminal with project and pipeline context. The announcement also identifies Custom Flows, triggered by GitLab events, as generally available.

A team can evaluate the workflow with a bounded task: upgrade a package, inspect the pipeline result and review the diff. The measure is how clear and reviewable the proposed fix becomes.

The direction matters because it addresses the work needed to deliver a useful change alongside generating additional code. Proposal quality and readiness for review become part of evaluating productivity, rather than simply counting how much the agent wrote.

## Sources

- [GitLab 19.2 announcement](https://about.gitlab.com/press/releases/2026-07-16-gitlab-19-2-brings-governed-agentic-automation/)
- [Dependency remediation](https://about.gitlab.com/blog/dependency-scanning-auto-remediation/)
- [Security Review Flow](https://about.gitlab.com/blog/gitlab-duo-security-review-flow/)
- [Duo CLI](https://about.gitlab.com/blog/gitlab-duo-cli-generally-available/)

**Sources:** GitLab — 19.2 release, 16 July 2026: https://about.gitlab.com/press/releases/2026-07-16-gitlab-19-2-brings-governed-agentic-automation/, GitLab — dependency remediation: https://about.gitlab.com/blog/dependency-scanning-auto-remediation/, GitLab — Security Review Flow: https://about.gitlab.com/blog/gitlab-duo-security-review-flow/, GitLab — Duo CLI: https://about.gitlab.com/blog/gitlab-duo-cli-generally-available/

---

Published by [Kurd Developers](https://kurddevelopers.com/) on 2026-07-16. Cite as: “GitLab 19.2 brings agents to dependency fixes and code review”, Kurd Developers, https://kurddevelopers.com/en/news/gitlab-19-2-agentic-security-cli-july-2026