CodeRabbit

The redesigned sidebar lists findings and nitpicks in separate sections grouped by file, and Fix with AI can hand off issues, nitpicks, or both. The Review view keeps the base branch and earlier branch reviews in view, and a CodeRabbit: Set up CLI and skills command installs the CodeRabbit CLI and agent skills from the editor.

cr review --gate major now exits with code 2 when a review reports a major or critical finding, letting scripts and agents block without parsing output. Also adds cr skills install/update/uninstall, cr usage --agent for credit balances, and proxy-based review routing.

The review status on GitHub is now a CodeRabbit check run that lists each review stage and its duration once the review ends, and shows skipped and rate-limited reviews as skipped or neutral. Required checks named CodeRabbit keep working; set reviews.review_progress to false to keep the commit status.

Delta Deep Scans check changed code and refresh security coverage between full scans. For GitHub repositories, coverage automation runs a delta when verified coverage drops below your target and scan requirements are met.

Deep Scan vulnerabilities gain a Runtime verification tab with a Reproducer Guide giving step-by-step instructions for checking in your own staging or test environment whether the issue is real. Runtime Analysis runs the guide in a CodeRabbit coding environment and keeps the evidence for inspection, on demand or automatically for new findings after a scan.

Project webhooks can now be migrated using headerless CSV lists of project or group IDs, full paths, or GitLab URLs with the existing --project and --group flags. Migration mode requires Python 3 and previews changes by default.

CodeRabbit now reads Claude Code rules from .claude/rules, with paths frontmatter applied only to matching globs and pathless rules scoped from their content like other guideline files. A matching filePatterns entry with applyTo still overrides a rule's paths.

Autofix, the one-off repair of selected review comments, is now Fix comments, while Autopilot, which repeatedly fixes review feedback and failing CI checks until a pull request is ready, becomes Autofix. Old commands including review commands keep working as aliases for a limited time, and earlier CLI versions still use the autopilot command until the next CLI release replaces it.

New cr code command manages cloud tasks including interactive messages, side questions, plans, and delivery, while signed Linux releases can now be verified and login and update failures recover more reliably. Also adds shell command completion and richer review JSON for agent mode.

AI Deep Scan can now use context from linked repositories to analyze the primary repository more thoroughly, sourcing dependencies such as a shared authentication library to investigate and verify security findings. Available in beta for GitHub Cloud on Essentials and above.

Admins can publish the CodeRabbit Security check with a severity threshold and require it in GitHub to block merges while qualifying Security comments remain unresolved on a pull request. Publishing the check alone does not block merges.

The AI Deep Scan code findings API is now available on all plans with a non-agentic API key and the security:read permission, no Enterprise plan, Security add-on, or Security trial required. Results stay limited to the key's authorized organization or workspace scope, and scan billing and other API plan requirements are unchanged.

Review summaries now list each repository guideline file CodeRabbit used and label it as configured, auto-discovered, or an Agent Skill.

A new script migrates existing CodeRabbit project webhooks to a new endpoint without recreating them, for a single project or all projects in a group. The migrate command previews changes by default and only updates with --apply, which rewrites the URL and destination secret together while preserving hook IDs and event settings.

A new reviews.allow_author_approval setting can be set to false to prevent pull request authors from using @coderabbitai approve and @coderabbitai resolve on their own pull requests. It defaults to true, and branch configuration cannot re-enable it once disabled.

Automatic repository linking now supports GitLab, including self-managed instances, and Bitbucket Cloud, controlled by knowledge_base.automatic_linking_mode with auto, enabled, or disabled values. The feature stays off by default, manual links are preserved, and discovery grows progressively as repositories are reviewed.

Triage is now available in beta for GitLab Cloud and self-managed GitLab organizations on the Team plan and higher, with docs covering access requirements, prioritization, views, and supported actions.

Triage rules act on pull requests matching conditions you choose, covering merge of low-risk changes, closing stale pull requests, asking the Coding Agent to auto-fix failed CI checks and review feedback, and recurring Slack reminders. Rules can be scoped by repository, file path, and labels, and merge, close, and Slack rules let you review matching pull requests before enabling them.

AI Deep Scan code findings can now include optional provenance identifying the scan, the primary repository revision, and selected context repositories; selection alone does not establish that a repository supplied evidence, and the primary repository remains the owner of the finding and its coverage. Paginated JSON leaves supporting evidence unloaded, CSV includes compact provenance, and SARIF includes the full available evidence.

Added cr review --deep for deep reviews, and cr handoff --summary creates a new CodeRabbit Cloud task from a committed and pushed branch, optionally including a plan and an available Codex or Claude Code session transcript. cr usage now shows included-review availability, and agent login surfaces the browser URL with guidance on restarting expired attempts.