What happened
On Oct 6, GitLab announced the foundation of its 'governed software factory': GitLab Dependency Firewall (early access) blocks/quarantines malicious, vulnerable or non-compliant packages before builds; Secrets Manager reaches GA with job-scoped secrets and one-click revocation; Artifact Central (beta) consolidates container/package control; plus Claude Mythos 5/5.1 powering Duo Agent Platform security-finding remediation, a Security Standard, and Impact Analytics.
Why it matters
GitLab is directly addressing the agentic-software-supply-chain problem — agents pulling unvetted packages and reusing stored credentials at machine speed — with policy controls that live where builds happen, an explicit attempt to govern AI-generated code on 10,000+ enterprise installs.
Applicability
DevSecOps/platform teams on GitLab that are adopting agentic coding should pilot Dependency Firewall (early access now) and adopt Secrets Manager (GA on GitLab.com; Self-Managed in 19.5).