npx @buildinternet/releases get coderabbitRecently shipped Triage Rules, which auto-merge low-risk pull requests, close stale ones, and auto-fix failing checks.
Triage acts on its own ranking.
Triage also reached GitLab Cloud and self-managed GitLab in beta on Team plans.
Security review can now block merges. Publishing the CodeRabbit Security check with a severity threshold and requiring it in GitHub blocks merges while qualifying comments stay unresolved. AI Deep Scan draws context from linked repositories — a shared authentication library, say — and reports provenance naming the scan and its context repositories. Its findings API opens to all plans with a security:read key.
GitLab and Bitbucket Cloud gained parity. Automatic repository linking, off by default, now discovers relationships there. A migration script moves existing GitLab project webhooks to a new endpoint, preserving hook IDs and event settings.
The CLI reviews without a checkout. cr review --remote owner/repo works from any directory. cr review --deep and cr usage cover deep reviews and remaining included-review capacity. cr code handoff and cr code skills import push local sessions and skills to the cloud; cr handoff still works, but its human-readable output changed — update scripts that parse it.
Approval and guideline controls tightened. Setting reviews.allow_author_approval to false stops authors from approving or resolving their own pull requests. Review summaries list which guideline files were used and whether they were configured, auto-discovered, or an Agent Skill.
New cr code command manages cloud tasks including interactive messages, side questions, plans, and delivery, while signed Linux releases can now be verified and login and update failures recover more reliably. Also adds shell command completion and richer review JSON for agent mode.
AI Deep Scan can now use context from linked repositories to analyze the primary repository more thoroughly, sourcing dependencies such as a shared authentication library to investigate and verify security findings. Available in beta for GitHub Cloud on Essentials and above.
Admins can publish the CodeRabbit Security check with a severity threshold and require it in GitHub to block merges while qualifying Security comments remain unresolved on a pull request. Publishing the check alone does not block merges.
The AI Deep Scan code findings API is now available on all plans with a non-agentic API key and the security:read permission, no Enterprise plan, Security add-on, or Security trial required. Results stay limited to the key's authorized organization or workspace scope, and scan billing and other API plan requirements are unchanged.
Review summaries now list each repository guideline file CodeRabbit used and label it as configured, auto-discovered, or an Agent Skill.
A new script migrates existing CodeRabbit project webhooks to a new endpoint without recreating them, for a single project or all projects in a group. The migrate command previews changes by default and only updates with --apply, which rewrites the URL and destination secret together while preserving hook IDs and event settings.
A new reviews.allow_author_approval setting can be set to false to prevent pull request authors from using @coderabbitai approve and @coderabbitai resolve on their own pull requests. It defaults to true, and branch configuration cannot re-enable it once disabled.
Automatic repository linking now supports GitLab, including self-managed instances, and Bitbucket Cloud, controlled by knowledge_base.automatic_linking_mode with auto, enabled, or disabled values. The feature stays off by default, manual links are preserved, and discovery grows progressively as repositories are reviewed.
Triage is now available in beta for GitLab Cloud and self-managed GitLab organizations on the Team plan and higher, with docs covering access requirements, prioritization, views, and supported actions.
Triage rules act on pull requests matching conditions you choose, covering merge of low-risk changes, closing stale pull requests, asking the Coding Agent to auto-fix failed CI checks and review feedback, and recurring Slack reminders. Rules can be scoped by repository, file path, and labels, and merge, close, and Slack rules let you review matching pull requests before enabling them.
AI Deep Scan code findings can now include optional provenance identifying the scan, the primary repository revision, and selected context repositories; selection alone does not establish that a repository supplied evidence, and the primary repository remains the owner of the finding and its coverage. Paginated JSON leaves supporting evidence unloaded, CSV includes compact provenance, and SARIF includes the full available evidence.
Added cr review --deep for deep reviews, and cr handoff --summary creates a new CodeRabbit Cloud task from a committed and pushed branch, optionally including a plan and an available Codex or Claude Code session transcript. cr usage now shows included-review availability, and agent login surfaces the browser URL with guidance on restarting expired attempts.
The new cr code handoff command starts a cloud Coding Agent task from a session summary, optional plan, and auto-discovered transcript. The existing cr handoff command still works but its human-readable output changed, so scripts parsing that output need updating; cr code skills import also brings local skills into the cloud library.
Programmatic .coderabbit.config.ts files can load shared fragments from an authorized repository via includeRemote({ repo, path, ref? }), defaulting to the organization's central coderabbit repository when repo is omitted. CodeRabbit's provider connection must be able to read the selected repository, and on pull or merge requests it also verifies the request author and the distinct human who started the review can read it.
The MCP server usage and review comment metrics endpoints return 503 while isolated metrics are preparing and include a Retry-After header, so clients should wait the indicated seconds and retry the same request.
Integrations calling GET /v1/metrics/mcp or GET /v1/metrics/review-comments should read the Retry-After response header when the API returns 503 while isolated metrics prepare, wait the specified seconds, then retry the same request.
CodeRabbit Triage consolidates all open pull requests across repositories into a single queue, ordered by priority from P0 to P3 with evidence-backed reasoning. Reviewers can define custom prioritization rules in plain language, filter and arrange the queue by saved views, act on PRs directly from cards, and receive daily digests in Slack. Requires GitHub Cloud and CodeRabbit Team plan or higher.
Reviews no longer duplicate file content and now report oversized requests with guidance to reduce review scope, while git branch detection avoids interactive credential prompts that can stall reviews. The Unix installer pins each download to a single release and rejects ZIP archives with mismatched checksums, and unverified findings stay inspectable without AI fix prompts and are counted separately.
CodeRabbit settings can now be defined in a programmatic .coderabbit.config.ts with PR-aware conditions, reusable merged fragments, local TypeScript and YAML includes, and shared includes from the organization's coderabbit config repository. The optional @coderabbitai/config SDK provides editor autocomplete and type checking, and existing YAML files keep precedence when both formats are present.
cr review --remote owner/repo --base main --source-branch feature reviews an installed GitHub repository from any directory, and cr config creates or updates repository settings with a preview before saving. Reviews mixing committed and uncommitted changes now use net changes for the selected comparison, and failed or incomplete reviews exit with code 1 while preserving received findings and the last successful checkpoint.