Showing News
Clear filtersLatest in CI/CD & Automation
Critical vm2 sandbox escape (CVSS 10.0) traced to its own README example
GitLab's Threat Research Group found a CVSS 3.1: 10.0 sandbox escape in vm2, a widely used Node.js sandbox library, in a config copied from vm2's own README. Version 3.11.7 fixes the attack, but the underlying risk remains for anyone using require.external. Update immediately and prefer containers for untrusted code.
GitLab Flex merges seats and AI into one budget
GitLab Flex reshapes one annual budget monthly across seats, AI credits, and features without re-procurement. Engineering leaders can shift spend from idle seats to agent usage instead of guessing headcount six months out. Ask at renewal.
GitLab Orbit unifies code lifecycle in live graph
GitLab Orbit beta unifies code, pipelines, and ownership in a live graph. Compare the Market tests show Orbit-grounded reviewers hit 70% accuracy versus 58% for RAG.
GitLab patches 13 CVEs including SAML account takeover flaw
GitLab 19.0.2, 18.11.5, and 18.10.8 patch 13 security flaws, including four High-severity CVEs like SAML account takeover (CVSS 8.7) and unauthenticated API DoS. Self-managed instances must upgrade immediately; GitLab.com is already patched.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles