GitLab 19.0: Secrets Manager, Agentic Merge Requests, and the DevSecOps Platform Bet
Enterprise Developer PlatformsGitLab 19.0 ships three capabilities that enterprise DevSecOps teams have been piecing together through separate tools: a native secrets manager, AI-powered merge request automation via Duo, and self-hosted open source model support for teams that cannot use external LLM APIs. The combination closes a real gap between writing code and deploying it securely.
The DevSecOps Integration Problem
Most teams managing secrets at scale today are running HashiCorp Vault or equivalent tools alongside their CI/CD pipeline — which means a separate credential store, separate access policy management, and a separate audit trail. When a pipeline secret is misconfigured or leaked, tracing it requires correlating logs across systems that don’t share a data model.
GitLab’s approach in 19.0 is to bring secrets management inside the platform. GitLab Secrets Manager (now in public beta for Premium and Ultimate users) stores credentials within GitLab and restricts each secret to authorized CI jobs, using the same group and project access controls already applied to code and pipelines. The audit trail is unified. A secret misconfiguration shows up in the same audit log as a code access event — not in a separate Vault audit system that requires a separate query.
What’s Actually in the Release
Secrets Manager (public beta): Native credential storage scoped to pipeline jobs. Eliminates the credential-to-external-vault integration layer for teams that don’t need Vault’s full feature surface. The HashiCorp Vault radar and secret remediation capability comparison will matter for teams evaluating whether to consolidate.
Duo AI merge request tools: Two new beta capabilities. “Resolve with Duo” evaluates both branches on a conflicting merge request, commits a proposed resolution, and leaves a summary comment for the next reviewer — reducing the context-switching cost of conflict resolution. One-click rebase-and-merge targets teams using semi-linear or fast-forward merge strategies, where the current UX requires multiple manual steps.
Self-hosted open source models: GitLab Duo Agent Platform Self-Hosted now supports four open source models: Mistral Devstral 2 123B, GLM-5.1, Kimi-K2.6, and MiniMax-M2.7. For regulated enterprises or teams with data residency requirements that block external API calls, this is the unlock for Duo features without sending code to a hosted LLM.
Dependency scanning and SBOM: Ultimate users get an auditable inventory of third-party components matched against GitLab security advisories — a supply chain audit record baked into the build process without requiring a separate tool.
The So What
The GitLab 19.0 release is a coherent platform consolidation play: secrets management, AI code assistance, supply chain security, and CI/CD in a single access control model. The competitive question is whether teams already running HashiCorp Vault at scale will consolidate onto GitLab Secrets Manager (simpler, less capable) or maintain the hybrid stack. For teams without existing Vault infrastructure, GitLab 19.0 removes the primary reason to adopt a separate secrets manager. For enterprise platform teams evaluating AI-assisted development workflows, the self-hosted model support changes the deployment calculus significantly — Duo features no longer require trusting code to an external API.
Photo by Digital Buggu on Pexels
Source: BusinessWire
Content created with AI assistance and reviewed for accuracy.
Join the conversation
Stack Insiders is our free community for readers who want to go deeper — share resources, ask questions, and connect with others across every vertical we cover.
Join Stack Insiders →