GitLab 19.2 makes Duo CLI and custom flows generally available

GitLab released version 19.2 on July 16 with GitLab Duo CLI and custom flows generally available. The official release page also highlights scheduled pipeline execution policies, a Security Review Flow for merge requests, and automated work on vulnerable dependencies.

Agents reach the terminal and shared catalog

Duo CLI puts agent interactions into a developer’s shell, while custom flows let organizations register multi-step automation for reuse. That can reduce context switching and standardize repeated tasks, but it also places tool permissions near credentials, source trees, and deployment commands. Teams should publish approved flows through a controlled catalog and pin or review their definitions like other executable dependencies.

Security Review Flow is described as reasoning about logic beyond known scanner patterns. Its output is a review signal, not a substitute for threat modeling or specialist review on high-impact changes. Measure which findings humans confirm and which classes it misses before relying on it as a gate.

Policy automation needs failure semantics

Scheduled pipeline execution policies allow centrally defined security or compliance jobs to run on a timetable. Operators should test what happens when a protected branch changes, a runner is unavailable, or the policy job fails. A scheduled scan that silently misses repositories can create a misleading green dashboard.

For dependency remediation, keep lockfile changes, transitive effects, and test results visible in the merge request. Avoid automatically merging a version bump solely because an agent generated it or a vulnerability identifier matches. Before rolling out 19.2 features, define execution identities, network access, approval points, and audit retention. General availability indicates supported functionality; each organization still owns the boundaries around what an agent or scheduled policy may change.