GitLab Dependency Scanning Auto-Remediation Is Now in Beta
Quick Reads
- GitLab launched Dependency Scanning Auto-Remediation in public beta.
- It automatically upgrades vulnerable packages and opens merge requests.
- AI resolves breaking changes caused by version bumps.
- Nothing merges without human approval, audit trails are intact.
- Available on GitLab.com, with Self-Managed and Dedicated rollouts underway.
Security backlogs are a persistent problem for engineering teams. GitLab is now addressing that head-on. The company has released Dependency Scanning Auto-Remediation in public beta, a feature that finds vulnerable dependencies and fixes them, automatically.
The need is urgent. A 2025 study of the Maven ecosystem found that roughly 63% of latest releases carry vulnerabilities through transitive dependencies. That figure dwarfs the 31% exposure from direct dependencies alone. Meanwhile, compliance frameworks like PCI-DSS and FedRAMP set 30-day remediation deadlines for high-severity findings. Most teams consistently miss those windows.
GitLab dependency scanning auto-remediation tackles this at the source. When SBOM-based dependency scanning detects a vulnerable package, GitLab opens a merge request to upgrade it. Furthermore, if the version bump breaks the build, the GitLab Duo Agent Platform analyzes the pipeline errors, reviews the dependency’s changelog, and commits a fix, all within the same merge request.
Critically, nothing merges automatically. Every change flows through existing approval gates and leaves a full audit trail. This balance of automation and control is exactly what compliance-conscious engineering teams need.
The feature covers a wide range of ecosystems. Supported package managers include Bundler, Maven, Gradle, and major Python and JavaScript/TypeScript tools. Support for Rust and Go is planned in the months ahead.
For software teams in Nigeria, this matters beyond the headline. Many engineering organizations here operate under tight timelines, lean security staffing, and pressure to ship fast. GitLab dependency scanning auto-remediation reduces the manual effort of clearing vulnerability backlogs. As a result, developers can stay focused on building features rather than chasing dependency fixes.
Automated dependency version bumping is included with GitLab Ultimate at no extra cost. Teams wanting agentic breaking-change resolution can access it via a free trial of GitLab Duo Agent Platform. Existing Ultimate subscribers can enable Duo Agent Platform and use their included GitLab Credits.
To try it, visit the Dependency Scanning Auto-Remediation documentation and get started today.
