What’s new in Eficode ROOT: November 2026

GitLab moves to version 19.5. This release turns several long-running projects into production-ready features and closes a quiet gap in how GitLab trusts signed commits. For your teams, that means CI/CD credentials can live in a built-in Secrets Manager instead of being scattered across variables and external vaults, and AI agents such as Claude Code or Cursor can work across GitLab through the now generally available MCP server. Secrets are handed only to the jobs that need them, under the same permissions and audit trail as your code, which limits the damage any leaked credential can do. And because commits signed with revoked GPG identities no longer count as verified, the Verified badge once again means exactly what it says.

Deprecations and removals

GraphQL secretPermissionUpdate and secretPermissionDelete mutations removed

With GitLab Secrets Manager reaching general availability, the secretPermissionUpdate and secretPermissionDelete GraphQL mutations have been removed. Scripts or integrations that manage secrets permissions must switch to projectSecretsPermissionUpdate and projectSecretsPermissionDelete. Learn more here.

cancel_merge_when_pipeline_succeeds endpoint deprecated

The REST API endpoint cancel_merge_when_pipeline_succeeds is deprecated in favour of the new cancel_auto_merge endpoint described under Project development. If your automations use the old endpoint, plan the switch. Learn more here.

Software Development Flow requires updated IDE extensions (All tiers)

The Software Development Flow now runs on the same Duo Agent Platform flow registry as other flows. To keep using it, update your editor extension to at least:

• GitLab for VS Code 6.85.0

• GitLab Duo plugin for JetBrains IDEs 3.40.0

• GitLab for Visual Studio 0.79.0

Learn more here.

Administration

Restrict GitLab Duo access by subgroup membership (All tiers)

The Restrict access based on group membership setting for GitLab Duo now accepts any subgroup, not only top-level groups. Direct members of the selected subgroup get access, which makes it easy to run a Duo Agent Platform pilot with one team or roll access out one division at a time, without restructuring your group hierarchy. Learn more here.

IAM roles for Amazon Bedrock self-hosted models (Premium, Ultimate)

Each self-hosted Amazon Bedrock model can now use its own IAM role, which the AI Gateway assumes when calling that model. Every model gets only the AWS access it needs, even when the role lives in another AWS account. Learn more here.

Configure job log update frequency (All tiers)

Administrators can now choose how often job logs update, anywhere from 3 to 3600 seconds, from the Admin area or the Settings API. Short jobs can show live logs sooner, without patching the instance. Reach out to us if you would like to adjust this setting on your instance. Learn more here.

Resync an LDAP-blocked user on demand (All tiers)

A new Resync with LDAP action on the Admin area Users page runs an LDAP access check for a single user and unblocks them if LDAP allows it. Previously, a blocked account stayed blocked until the daily sync or the next sign-in, which service accounts can never do. Learn more here.

AI

GitLab MCP server is generally available (All tiers)

The GitLab MCP server is now generally available. Any MCP-compatible agent, such as Claude Code or Cursor, gets direct access to the expanded GitLab tool catalog and can run Duo Agent Platform agents and flows without leaving the developer’s preferred tool. Learn more here.

New GitLab MCP server tools (All tiers)

• CI/CD artifacts: get_artifact_file reads a single file from a job’s artifacts, so agents no longer have to download and unzip the whole archive

• Duo agents and flows: start, track and list GitLab Duo agent sessions from any MCP client

• Groups: list_groups lets agents browse the group hierarchy instead of guessing IDs or paths

Learn more here.

MCP server toolset selection (All tiers)

You can now choose which toolsets the GitLab MCP server exposes. Fewer unnecessary tools means less wasted context for the model and less confusion when several MCP servers are connected at once. Learn more here.

Follow-up reviews in Code Review Flow (All tiers)

When you ask GitLab Duo to review a merge request again, it now builds on its earlier review threads and your replies. It focuses on the lines added since the last review, does not repeat points it already raised, and leaves alone anything you explained as intentional. Learn more here.

Recommend reviewers with GitLab Duo (Premium, Ultimate)

The generally available Recommend Reviewers Flow suggests the minimum number of reviewers for each approval rule, based on availability, workload, time zone and recent activity. Recommendations appear in the Recommended section of the merge request sidebar. Learn more here.

Provide images as context for Developer Flow and Agentic Chat in your IDE (All tiers)

The Developer Flow and Agentic Chat in your IDE can now read images from your repository and attachments on issues, merge requests and comments in the same project. Screenshots in bug reports and diagrams in design discussions finally reach the model. Reference an existing image by its path or upload reference. Learn more here.

New Agentic Chat UI generally available in IDEs (Premium, Ultimate)

The redesigned Agentic Chat layout, introduced as a beta in 19.3, is now generally available and the default in GitLab for VS Code 7.2.0 and the GitLab Duo plugin for JetBrains IDEs 3.50.0. Conversations, chat history and agent and model selection all live in one view. Learn more here.

Start a custom flow in GitLab Duo Agentic Chat (All tiers)

Any AI Catalog flow enabled in your project can now be started directly from Agentic Chat, without configuring a trigger first. Your message becomes the flow’s goal, which makes testing and iterating on custom flows much faster. Learn more here.

/goal command in GitLab Duo CLI is generally available (Premium, Ultimate)

Introduced last month, the /goal command is now generally available. Describe an open-ended goal, and GitLab Duo delegates it to a governed flow that runs locally and handles both implementation and verification. Learn more here.

Auto mode in GitLab Duo CLI (Premium, Ultimate)

In the new auto mode, GitLab Duo uses tools without asking for approval first, so longer tasks run without stopping at every shell command or MCP tool call. Auto mode is off by default, can be locked off for the whole instance or group, and tools set to Always Deny stay blocked. Learn more here.

Configure GitLab Duo CLI with settings files (Premium, Ultimate)

GitLab Duo CLI settings can now live in a settings file. Organizations can also deploy a managed settings file through device management or group policy, and those settings take precedence and cannot be changed by users. Learn more here.

Improved first-run experience in GitLab Duo CLI (Premium, Ultimate)

New users get an onboarding card for connecting MCP servers and installing plugins, suggested prompts based on their open merge requests and issues, a status bar with branch and project context, and token validation during setup. Learn more here.

Connect Externally Connected Agents to AI Governance (Beta) (Premium, Ultimate)

After a one-time glab govern setup, sessions from external agents such as Claude Code, Cursor and Codex appear in the AI Governance Dashboard and AI audit events next to your Duo Agent Platform agents, including who ran them, in which project and when. Audit events can also be streamed to your SIEM. Learn more here.

Trigger flows with a generally available API (Premium, Ultimate)

The endpoint for triggering Duo Agent Platform flows from pipelines, scripts and other automation is now generally available and follows the GitLab REST API breaking change policy, so it is safe to build production automation on. Learn more here.

UI/UX

Embed code from a repository in Markdown (All tiers)

Permalinks to lines in a file now render as a syntax-highlighted snippet with the file path and commit, so you can read the referenced code without leaving the issue, merge request or wiki page. Snippets are shown only to users with read access to the repository. Learn more here.

Sort Markdown tables by column (All tiers)

Rendered Markdown tables can now be sorted by any column, in view mode and in preview, with a reset option to restore the original order. Keyboard sorting is supported too. Learn more here.

Sticky headers for Markdown tables (All tiers)

Table headers now stay visible as you scroll through long tables, in view mode, preview and the rich text editor. No configuration is needed. Learn more here.

Commit count variable in commit templates (All tiers)

Merge commit, squash commit and merge request description templates now support %{commits_count}. For example, %{title} (%{commits_count} commits) renders as “Bugfix (3 commits)”. Learn more here.

Other additions to the interface (All tiers)

• Changing the required approvals in merge request settings now confirms success or shows an error

• Archived labels are marked in issue and merge request lists and can no longer be newly assigned

• The Create branch dialog keeps its submit button disabled until the branch name is validated

• Right-aligned Markdown table columns use fixed-width numerals for easier reading

Learn more here.

Reporting

Non-default branch tracking generally available (Ultimate)

Vulnerabilities can now be tracked on branches other than the default branch, which is ideal for long-lived release or environment branches. This release lets you:

• Track up to three additional branches or tags on the security configuration page

• Filter the vulnerability report by tracked ref and the project security dashboard by branch

• Update vulnerability status on tracked branches, with vulnerability management policies evaluating each branch separately

Learn more here.

Revoked GPG identities no longer verify commits (All tiers)

GitLab now ignores user IDs that GPG reports as revoked. A revoked identity no longer counts as a verified email for the Verified badge, so commits signed under it are no longer shown as verified, and a key whose identities are all revoked verifies nothing. Learn more here.

GitLab Observability is now in beta (All tiers)

GitLab Observability has moved from experiment to beta. Send traces, metrics and logs with OpenTelemetry and explore them next to your code, merge requests and pipelines. On self-managed instances, the Observability backend has to be hosted separately, so reach out to us if you would like to try it. Learn more here.

Repository tags and Terraform states in GraphQL (All tiers)

GraphQL now exposes repository tags with search, sorting and pagination (as an experiment) and the version history of Terraform states. The merge requests REST API also returns author.bot, so bot and service account authors can be told apart without extra calls. Learn more here.

Project development

GitLab Secrets Manager is generally available (Premium, Ultimate)

GitLab Secrets Manager is a built-in, OpenBao-based secrets store that uses your existing group and project permissions, so there is no separate access model to maintain. Each CI/CD secret is scoped to the jobs that need it based on environment, branch and branch protection rules, its value is masked in job logs, and every create, read, update and delete is audited. Secrets Manager is a paid add-on that consumes GitLab Credits and requires an OpenBao deployment alongside GitLab. If you would like to use it on your instance, reach out to us and we will plan it together. Learn more here.

Child pipelines can depend on parent jobs optionally (All tiers)

A child pipeline job can now mark its dependency on a parent job as optional. If the parent job runs, the child waits for it as usual; if it is skipped, for example because certain files did not change, the child job goes ahead. No more duplicate jobs or brittle workarounds. Learn more here.

Cancel auto-merge from the REST API (All tiers)

The new cancel_auto_merge endpoint cancels an active auto-merge and also removes the merge request from a merge train. In addition, git push -o merge_request.auto_merge is now rejected when you are not allowed to merge to the target branch. Learn more here.

Submit a review to become a reviewer (All tiers)

When you submit a review on a merge request you are not yet reviewing, GitLab now adds you to the Reviewers list automatically, so the list always reflects who actually took part in the review. Learn more here.

GitLab Relay (KAS) connections default to gRPC (All tiers)

New GitLab agent for Kubernetes installations now connect over grpcs:// instead of gRPC wrapped in WebSocket, giving one protocol to route and troubleshoot. Existing agents using wss:// keep working, but we recommend moving them to the address shown in the agent installation command after the upgrade. Learn more here.

Ultimate only

Customize security configuration profiles

Secret Detection and SAST profiles can now be customized in the UI, including excluded paths, custom analyzer images and full Git history scans. Set them once for a group and apply them to all its projects, instead of editing .gitlab-ci.yml in every project. Learn more here.

AI flows supported on non-default branches

SAST False Positive Detection, SAST Vulnerability Resolution and Secret False Positive Detection can now run on vulnerabilities in any tracked branch, so findings can be analysed and fixed before merging. Learn more here.

Accurate merge request security report comparisons

The merge request security report now compares up to 1,000 findings per severity instead of 25, so unchanged findings no longer show up as new or fixed. Learn more here.

Share filtered views of the security inventory

The full filter state of the security inventory is now kept in the URL. Filter by tool coverage, vulnerability count or project name, then bookmark the view or send the link to the team that owns those projects. Learn more here.

HashiCorp Vault moves to version 2.2. The release closes a large number of security issues, tightens how access policies are evaluated and prepares the PKI engine for the post-quantum era. For you, this means a better-protected secrets platform, although a few policy patterns that used to work may behave differently, so please read the breaking changes section below before the maintenance window. Day to day, the refreshed UI with its long-awaited dark mode makes working with Vault easier on the eyes. Behind the scenes, ML-DSA support lets you start testing quantum-resistant certificates, and automated rotation parameters make credential rotation more consistent across your roles.

Deprecations and breaking changes

Stricter policy evaluation

Several fixes close ways in which ACL policies could be bypassed. They make Vault safer, but policies that relied on the old behaviour need to be reviewed:

• Lowercase resource names: paths that target specific roles, policies, users or similar resources (for example AppRole or Kubernetes roles, userpass usernames or policy names) are now matched in lowercase. A rule written with a mixed-case name, such as auth/approle/role/MyRole, no longer matches and must be rewritten in lowercase. This matters most for deny rules, which otherwise stop protecting the resource

• LIST with a trailing slash: list requests now respect more specific deny rules, so some listings that were previously allowed may now be denied

• Policy names: names that are empty or contain . or .. path segments are rejected, and existing policies with such names are no longer applied

• Duplicate HCL attributes: policies containing duplicate attributes can no longer be parsed

We will check your policies for these patterns before the upgrade and contact you if anything needs to change. If you manage policies yourself, for example through Terraform, please review them in advance. Learn more here.

ACME finalization rejects unverified SAN types

With the default sign-verbatim ACME directory policy, the PKI engine now rejects certificate requests containing URI, email or other SANs, because ACME challenges only verify DNS names and IP addresses. If you rely on the old behaviour, reach out to us and we will discuss the options. Learn more here.

Dark mode (beta)

The Vault UI now supports light, dark and system-preferred themes. To change it:

1. Open the account menu and select Preferences.

2. In the Appearance section, choose Light, Dark or System.

Learn more here.

ML-DSA support in PKI

The PKI secrets engine can now issue certificates with ML-DSA keys, a NIST-standardized post-quantum signature algorithm. Teams preparing for the post-quantum transition can start testing quantum-resistant certificates in their own environments today. Learn more here.

Automated rotation parameters in rotation policies

Rotation policies, which define reusable retry behaviour for failed automated credential rotations, now also support automated rotation parameters. This makes it easier to standardize how and when credentials are rotated across your roles. Learn more here.

Other improvements

• The PKI engine can return certificate bundles as password-protected PKCS#12 (PFX) and Java keystore (JKS) files

• KV v2 secrets can be viewed in YAML, alongside the existing UI and JSON views

• TLS certificate authentication is now available as a login method in the UI

• New onboarding intros for secrets engines, authentication methods, ACL policies, entities and groups explain each feature without leaving the UI

• A redesigned secrets engines catalog with search makes it easier to pick the right engine

Learn more here.

From start of December Eficode ROOT enters its end-of-year freeze period. During this time, no new feature versions are released to your tools, and the focus shifts entirely to stability and security. Our teams carry out maintenance work, apply security fixes and update the underlying server systems, so your platform starts the new year on a solid, well-patched foundation. As usual, your service manager will let you know in advance about any maintenance that may affect your services. Feature upgrades resume in [month], so if there is something you would like to see before the freeze, reach out to us in good time.

That’s all for November! See you after the freeze!