InfoQ - Application Security - News

GitLab 19.0 Embeds Agentic AI in Secrets, Merge Requests, and Supply Chain Security

Mark Silvester — Fri, 19 Jun 2026 08:00:00 GMT

GitLab 19.0 extends agentic AI beyond code generation into securing credentials, reviewing and merging changes, and scanning dependencies, adding a public beta Secrets Manager, a full merge request Developer Flow, usage-based GitLab Duo billing, and generally available SBOM dependency scanning.

By Mark Silvester

VS Code 1.123 Adds Two-Hour Extension Update Delay to Limit Supply Chain Attacks

Steef-Jan Wiggers — Thu, 18 Jun 2026 10:15:00 GMT

VS Code 1.123 adds a two-hour delay before auto-updating extensions to newly published versions, creating a revocation window against supply chain attacks. The delay does not apply to trusted publishers like Microsoft, GitHub, and OpenAI. Similar cooldown mechanisms have now spread across pip, RubyGems, npm, pnpm, Yarn, and Bun.

By Steef-Jan Wiggers