UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF CALIFORNIA

ARLIE DOLLY, et al., Case No. 24-cv-06244-EKL

Plaintiffs, ORDER GRANTING MOTION TO 9 v. DISMISS

10 GITLAB INC., et al., Re: Dkt. Nos. 50, 52 Defendants.

In this putative securities class action, Lead Plaintiff Dutch Smith alleges that GitLab Inc. (“GitLab”) and its executives Sytse Sijbrandij, Brian Robins, and David DeSanto (“Individual Defendants”) knowingly made false and misleading statements to investors about the company’s products and their artificial intelligence (“AI”) capabilities, customer feedback, competitiveness in the market, and financial projections. Second Am. Compl., ECF No. 47 (“SAC”). Plaintiff also alleges that subsequent financial disclosures revealed Defendants’ fraudulent conduct and caused GitLab’s inflated stock prices to drop, harming investors. Id. GitLab and Individual Defendants (together, “Defendants”) move to dismiss the case for failure to state a claim. Mot. to Dismiss SAC, ECF No. 50 (“Motion”). The Court reviewed the parties’ briefs and relevant authority, provided the parties with a tentative ruling, and heard argument on August 7, 2025. For the following reasons, the motion is GRANTED with leave to amend. I. BACKGROUND1 Plaintiff claims that Defendants overhyped the potential of AI in the software development cycle at a time when the market had concerns about using AI with highly sensitive data. GitLab

also felt that it needed to compete with rival AI products, like GitHub’s, to avoid falling behind. Defendants’ optimistic assumptions regarding customer demand for AI features led Defendants to make the ultimately incorrect decision to increase prices. Plaintiff argues that Defendants knew about the company’s suboptimal AI capabilities and financial forecasts, yet failed to disclose important information, thereby misleading investors. A. Company Background GitLab provides a one platform solution that integrates security into the automation of the software development cycle. SAC ¶¶ 44, 84. Instead of splitting software development projects among different teams, GitLab’s goal is for software development and operations teams to collaborate using AI-powered processes to make workflow more efficient. See id. ¶¶ 43-46. The underlying mechanism of this solution is DevSecOps, an enhanced version of the DevOps methodology that adds security (Sec) to software development (Dev) and informational technology operations (Ops). Id. ¶¶ 43-44. While competitors like GitHub focus on incorporating AI for software developers to write and complete code, GitLab aims to also automate processes for testing security issues and protecting highly sensitive data to enhance efficiency. See id. ¶ 77. GitLab 16 was the newest iteration of GitLab’s AI-powered DevSecOps platform during the Class Period – June 5, 2023 to June 3, 2024. Id. ¶ 84. GitLab’s pricing structure has three tiers: Free, Premium, and Ultimate. Id. ¶ 48. Most of GitLab’s revenue historically comes from Premium tier subscriptions. Id. ¶ 58. On March 2, 2023, GitLab announced a price increase on its Premium tier subscription from $19 to $29 per user per month, effective April 3, 2023. Id. ¶ 87. GitLab expected the price increase to nominally increase revenue for the fiscal year ending January 31, 2024 (“FY 2024”) and to significantly increase revenue for the fiscal year ending January 31, 2025 (“FY 2025”). Id. ¶ 96. B. Allegedly False and Misleading Statements Following the price increase announcement, Defendants allegedly made false and misleading statements to investors. During the Class Period, Defendants allegedly misrepresented (1) GitLab’s AI capabilities in order to drive market demand, (2) customers’ evaluations and competitive with Copilot, GitHub’s AI coding assistant, and (4) the projected financial implications of the Premium tier price increase. Id. ¶¶ 142, 173. The Court does not list all of the challenged statements here, but includes the following illustrative examples: 1. Statements about GitLab’s AI capabilities • “[O]ur customers now can now [sic] run AI and ML [machine learning] workloads on GPU-enabled GitLab Runners on the Oracle Cloud Infrastructure[.]” Id. ¶ 152. • “Code Suggestions uses generative AI to suggest code to developers. Suggested Reviewers leverages AI to identify the most appropriate reviewers of code. Explain[] This Vulnerability provides details about potential security vulnerabilities in code.” Id. ¶ 161. • “We already have 14 AI features available to our customers.” Id. ¶ 195; see also id. ¶ 203. 2. Statements about customers’ evaluations and concerns • “[W]e expect customers will increasingly turn to GitLab as they build machine learning models and AI into their applications.” Id. ¶ 148. • “[T]he early feedback to Duo has been very positive. . . . [C]ustomers recognize that they need a suite of AI features, and therefore, we’re excited about Duo.” Id. ¶ 168. • “Our customers have reported efficiency improvements upwards of 50% with Code Suggestions. . . . We also spoke with a multinational financial technology company, and their team is excited about using GitLab Duo[.]” Id. ¶ 203. 3. Statements about GitLab’s intent to compete with GitHub • “The real promise of AI extends far beyond code creation. And this is where GitLab has a structural advantage. . . . And to date, GitLab has more AI features geared towards developers than our competitors.” Id. ¶ 148. • “So we’re winning deals against GitHub because we have the most comprehensive platform. . . . [B]ecause we are better able to address those use cases [i.e., security scans], we’re also able to build AI features that build on that, for example, the ability to explain vulnerabilities and to have the AI suggest a fix.” Id. ¶ 208.

4. Statements about the Premium tier price increase • “The price increase, which took effect on April 3, [2023,] is going as planned. We only had 1 month of renewals impacted by the price increase in the quarter. To date, customer churn is unchanged for the Premium customers who renewed in April, and our average [annual recurring revenue] per customer increased in line with our expectations.” Id. ¶ 150. • “[W]e really only had a short period of less than a month, . . . [but] the renewal rates and the churn and the land of new customers have been better than expected.” Id. ¶ 155. • “[O]verall bookings [are] more positive than our internal forecast and churn is less. And so we’re seeing positive signs on every element of how we modeled it from a bookings and churn perspective.” Id. ¶ 166. C. Scienter and Loss Causation Plaintiff claims that Individual Defendants intentionally or recklessly failed to disclose facts regarding delayed AI features, weak market demand, and slowed or stalled “seat expansion,” i.e., the growth of individual licenses sold to existing customers. See id. ¶¶ 119, 216. When GitLab later announced its financial results for the fourth quarter of FY 2024 (“4Q24”) and the first quarter of FY 2025 (“1Q25”), each of the two disclosures allegedly revealed Defendants’ fraudulent conduct and thus caused GitLab’s inflated stock price to drop. Id. ¶ 252. 1. GitLab’s 4Q24 disclosures In a March 4, 2024 press release, GitLab announced its 4Q24 results of a positive revenue and growth rate, yet revealed a lower-than-expected guidance for 1Q25. GitLab’s 4Q24 results consisted of a quarterly revenue of $163.8 million and a growth rate of 33% year-over-year (“y/y”), and an annual revenue of $579.9 million and a growth rate of 37% y/y. Id. ¶ 5. GitLab’s guidance for 1Q25 consisted of an expected annual revenue range of $725 million to $731 million for FY 2025 and a growth rate of approximately 26% y/y. Id. In the earnings call, Defendants informed investors that GitLab had not yet finished analyzing its standalone selling price (“SSP”), which represents the cost of each product when sold individually, for FY 2025. Id. ¶ 8. An SSP products in bundles. See id. Thus, Defendants explained that they did not factor in any change in SSP for the company’s 1Q25 guidance when asked about their lower-than-expected future estimates. Id. ¶ 8. Whereas before the Class Period Defendants expected significant revenue contributions from the Premium tier price increase in FY 2025, Defendants now expected these contributions would be delayed until FY 2026. Id. ¶ 7. The 1Q25 guidance confirmed a negative shift in financial projections and customer buying behavior that Defendants allegedly failed to reveal prior to the press release. See id. ¶ 261. On March 5, 2024, the day after the press release, GitLab’s stock price dropped approximately 21% from $74.47 to $58.84 per share. Id. ¶ 9. 2. GitLab’s 1Q25 disclosures In a June 3, 2024 press release, GitLab announced its 1Q25 results of an approximately 21% growth y/y in Annual Recurring Revenue (“ARR”), landing 5 points below the previously expected 26% growth y/y that Defendants had estimated in their guidance. Id. ¶ 11; see also Supp. Tang Decl. Ex. 23 at 1, ECF No. 64 (stating 21% growth y/y in “calculated billings”).2 GitLab’s Dollar-Based Net Retention Rate (“DBNRR”), a financial metric that shows revenue growth within the existing customer base, dropped by 1 point to 129%. SAC ¶ 11. GitLab also announced that it had completed its SSP analysis, resulting in “an estimated $4 million headwind to FY 2025 revenue guidance” compared to the initial 1Q25 guidance given along with the 4Q24 disclosures. Id. Plaintiff argues that this headwind further revealed a steep decline of net new Premium tier users in the quarter, contrary to Defendants’ prior optimism of the market. Id. ¶ 138. The next day, GitLab’s stock price dropped about 5% from $47.07 to $44.75 per share. Id. ¶ 12. D. Procedural History On September 4, 2024, Arlie Dolly filed the original complaint in this action. ECF No. 1. On December 23, 2024, the Court appointed Dutch Smith as Lead Plaintiff. ECF No. 36. On February 5, 2025, Lead Plaintiff filed an amended complaint. ECF No. 41. On March 7, 2025, Lead Plaintiff filed the operative second amended complaint pursuant to stipulation. See ECF No. 44.

Plaintiff alleges that Defendants violated Section 10(b) of the Securities Exchange Act of 1934 (“Exchange Act”) and Rule 10b-5, promulgated by the United States Securities and Exchange Commission (“SEC”). SAC ¶ 1. Plaintiff also alleges that Individual Defendants were controlling persons of GitLab and thus violated Section 20(a) of the Exchange Act. Id. ¶¶ 284- 289. Plaintiff seeks to recover damages on behalf of all persons and entities who purchased or otherwise acquired GitLab securities during the Class Period and suffered a loss. Id. Defendants move to dismiss for failure to state a claim under Federal Rules of Civil Procedure 12(b)(6) and 9(b), and the Private Securities Litigation Reform Act of 1995 (“PSLRA”). Mot. at 1. Defendants contend that Plaintiff has not plausibly alleged false or misleading statements, scienter, or loss causation. See id. at 10-20. Defendants also move to dismiss the Section 20(a) claim that is derivative of the Section 10(b) and SEC Rule 10b-5 claim. Id. at 25. II. REQUEST FOR JUDICIAL NOTICE In ruling on a Rule 12(b)(6) motion, courts generally do not consider material outside the pleadings. United States v. Corinthian Colls., 655 F.3d 984, 998 (9th Cir. 2011). However, courts may consider “documents incorporated in the complaint by reference[.]” Tellabs, Inc. v. Makor Issues & Rts., Ltd., 551 U.S. 308, 322 (2007). Incorporation by reference “treats certain documents as though they are part of the complaint itself. The doctrine prevents plaintiffs from selecting only portions of documents that support their claims, while omitting portions of those very documents that weaken – or doom – their claims.” Khoja v. Orexigen Therapeutics, Inc., 899 F.3d 988, 1002 (9th Cir. 2018). “[A] defendant may seek to incorporate a document into the complaint ‘if the plaintiff refers extensively to the document or the document forms the basis of the plaintiff’s claim.’” Id. (quoting United States v. Ritchie, 342 F.3d 903, 907 (9th Cir. 2003)). In ruling on a Rule 12(b)(6) motion, courts may also consider “matters of public record.” Fed. R. Evid. 201(b). For example, courts may take judicial notice of SEC filings because they are publicly available documents whose accuracy cannot reasonably be questioned. Fed. R. Evid. 201(b); see also In re Bare Escentuals, Inc. Sec. Litig., 745 F. Supp. 2d 1052, 1066-67 (N.D. Cal. documents required to be filed with the SEC[.]”). But courts should consider SEC filings “only for the purpose of determining what statements the documents contain, not to prove the truth of the documents’ contents.” Troy Grp., Inc. v. Tilson, 364 F. Supp. 2d 1149, 1152 (C.D. Cal. 2005) (quoting Lovelace v. Software Spectrum, Inc., 78 F.3d 1015, 1018 (5th Cir. 1996)). Defendants ask the Court to consider certain earnings statements, earnings call transcripts, SEC filings, and market analyst reports. Defendants argue that the Court may consider Exhibits 1- 2, 4-5, 7-14, and 18-22 because they are incorporated by reference in the complaint. See Req. for Jud. Notice at 3, ECF No. 52 (“RJN”). “Plaintiff does not object to the Court’s consideration of Exhibits 1-2, 4-5, 7-14 and 18-22 for their existence and contents under the doctrine of incorporation by reference as Plaintiff has quoted or otherwise relied on portions in the Complaint.” Opp. to RJN at 9, ECF No. 56. Defendants also ask the Court to take judicial notice of Exhibits 1-6, 10-12, 15-24. See RJN at 4-5; see also Supp. RJN at 2, ECF No. 63. Judicial notice of these materials is appropriate because they are SEC filings and analyst reports, and their accuracy cannot reasonably be questioned. Plaintiff does not object to the Court judicially noticing these materials for “their existence and contents.” Opp. to RJN at 8. Plaintiff objects to the Court’s consideration of any exhibit “for the purpose of disputing Plaintiff’s well-plead factual allegations.” Id. The Court has not identified any factual disputes raised by these materials, and in any event, the Court will not consider the exhibits for an improper purpose. Accordingly, Defendants’ requests for incorporation by reference and judicial notice are GRANTED.3 III. LEGAL STANDARD Under Federal Rule of Civil Procedure 12(b)(6), courts must dismiss a complaint if it fails to state a claim upon which relief can be granted. To avoid dismissal, plaintiffs must allege “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). A claim is facially plausible when the pleaded facts allow the court “to

3 Additionally, the Court may consider Exhibits 1-19 to the extent they contain cautionary draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). For purposes of a Rule 12(b)(6) motion, courts generally “accept factual allegations in the complaint as true and construe the pleadings in the light most favorable to the nonmoving party.” Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). However, courts need not “assume the truth of legal conclusions merely because they are cast in the form of factual allegations.” Fayer v. Vaughn, 649 F.3d 1061, 1064 (9th Cir. 2011) (per curiam) (quoting W. Mining Council v. Watt, 643 F.2d 618, 624 (9th Cir. 1981)). If courts find that dismissal pursuant to Rule 12(b)(6) is warranted, “court[s] should grant leave to amend even if no request to amend the pleading was made, unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1127 (9th Cir. 2000) (en banc) (quoting Doe v. United States, 58 F.3d 494, 497 (9th Cir. 1995)). IV. DISCUSSION Defendants move to dismiss on the following grounds. First, the complaint is puzzle-pled. Second, the alleged false and misleading statements are inactionable and unsupported by particularized facts. Third, the complaint does not plausibly allege that Individual Defendants acted with scienter. Fourth, the complaint fails to plausibly allege that Defendants’ alleged fraud caused GitLab’s two stock price drops. The Court finds that the complaint should not be dismissed for puzzle pleading, but grants the motion in all other respects. First, Plaintiff alleges that Defendants knowingly misrepresented or omitted important information because GitLab underperformed compared to previous financial forecasts. However, many of the allegedly false and misleading statements are inactionable because they are forward-looking statements, puffery, or otherwise inactionable opinions. Plaintiff also fails to plead with particularity how any actionable statement contradicts information that Defendants materially omitted or misrepresented. Plaintiff likewise fails to plead with particularity how Individual Defendants were intentional or reckless in failing to disclose information. Finally, Plaintiff fails to plead with particularity what new information the two corrective disclosures revealed that would indicate fraudulent conduct and cause stock prices to its financial projections. Because the primary Section 10(b) claim fails, the Court also dismisses the derivative Section 20(a) claim. A. Puzzle Pleading Defendants argue that the complaint should be dismissed for puzzle pleading. Mot. at 8. A puzzle pleading is a complaint that puts undue burden on defendants and courts to identify the statements at issue and to match them up with reasons why the statements are false or misleading. See In re GlenFed, Inc. Sec. Litig., 42 F.3d 1541, 1554 (9th Cir. 1994) (en banc); In re Autodesk, Inc. Sec. Litig., 132 F. Supp. 2d 833, 842 (N.D. Cal. 2000). The PSLRA requires plaintiffs to craft their complaints in a way that avoids such burden. In re Splash Tech. Holdings, Inc. Sec. Litig., 160 F. Supp. 2d 1059, 1075 (N.D. Cal. 2001). Thus, plaintiffs in securities cases must avoid “rambl[ing] through long stretches of material quoted from defendants’ public statements . . . unpunctuated by any specific ‘reasons for falsity,’” which “makes the nature of the fraud difficult to divine[.]” GlenFed, 42 F.3d at 1553-54. Here, the complaint is not a puzzle pleading. First, the allegedly false and misleading statements are listed chronologically in a clearly designated section titled “Defendants’ Materially False and Misleading Statements.” See, e.g., SAC ¶ 143; cf. Wenger v. Lumisys, Inc., 2 F. Supp. 2d 1231, 1243 (N.D. Cal. 1998) (dismissing complaint that lumped together all alleged misrepresentations spanning across eight months). Second, the complaint delineates the statements allegedly made by each Individual Defendant. See, e.g., SAC ¶ 145; cf. Splash, 160 F. Supp. 2d at 1073 (dismissing complaint for not specifying which of the individual defendants allegedly made certain statements). Third, the complaint groups a number of statements together at a time and provides reasons why they are allegedly false or misleading.4 See, e.g., SAC ¶¶ 145- 147; see also Kampe v. Volta Inc., No. 22-cv-02055-JST, 2024 WL 4534732, at *6 (N.D. Cal. Oct. 21, 2024) (“The [complaint] is generally organized in a manner that permits the reader to connect the allegedly false or misleading statements with the reasons why [p]laintiff challenges those statements.”).

The cases cited by Defendants are inapposite because the structure of the complaint here is different from the puzzle-like complaints that other courts found perplexing. The complaint is not so confusing or disorganized that the Court is unable to identify the alleged statements and the corresponding reasons for falsity.5 Cf. Lu v. Align Tech., Inc., 417 F. Supp. 3d 1266, 1274 (N.D. Cal. 2019) (dismissing the complaint for lack of clarity between allegations and contextual statements); In re Aqua Metals, Inc. Sec. Litig., No. 17-cv-07142-HSG, 2019 WL 3817849, at *8 (N.D. Cal. Aug. 14, 2019) (dismissing the complaint because matching hundreds of statements with corresponding reasons for falsity is unduly burdensome). Accordingly, the Court declines to dismiss the complaint for puzzle pleading. B. Section 10(b) and SEC Rule 10b-5 Claim To state a claim for damages under Section 10(b) and SEC Rule 10b-5, plaintiffs must allege “(1) a material misrepresentation or omission by the defendant; (2) scienter; (3) a connection between the misrepresentation or omission and the purchase or sale of a security; (4) reliance upon the misrepresentation or omission; (5) economic loss; and (6) loss causation.” In re Quality Sys., Inc. Sec. Litig., 865 F.3d 1130, 1140 (9th Cir. 2017) (quoting Halliburton Co. v. Erica P. John Fund, Inc., 573 U.S. 258, 267 (2014)). Securities fraud cases must meet the “higher, exacting pleading standards” of Federal Rule of Civil Procedure 9(b) and the PSLRA. Or. Pub. Emps. Ret. Fund v. Apollo Grp. Inc., 774 F.3d 598, 604 (9th Cir. 2014). “If the complaint does not satisfy the PSLRA’s pleading requirements, the Court must grant a motion to dismiss the complaint.” Shenwick v. Twitter, Inc., 282 F. Supp. 3d 1115, 1133 (N.D. Cal. 2017) (citing 15 U.S.C. § 78u–4(b)(3)(A)). Rule 9(b) requires plaintiffs to “state with particularity the circumstances constituting fraud or mistake.” This means that plaintiffs must allege the “‘who, what, when, where, and how’ of the misconduct charged.” Kearns v. Ford Motor Co., 567 F.3d 1120, 1124 (9th Cir. 2009) (quoting

5 On the whole, the complaint is clear enough and not puzzle-pled. However, there are isolated 27 examples of lengthy block quotations without any bolded or italicized portions to clearly identify the statements that Plaintiff claims to be false or misleading. See, e.g., SAC ¶¶ 178, 205. Plaintiff Vess v. Ciba-Geigy Corp. USA, 317 F.3d 1097, 1106 (9th Cir. 2003)). The Rule 9(b) particularity requirement “applies to all elements of a securities fraud action[.]” Apollo Grp., 774 F.3d at 605. Here, Plaintiff fails to plead with particularity why Defendants’ statements are false and misleading, how Individual Defendants were intentional or reckless, and what new information was revealed by the two alleged corrective disclosures that caused GitLab’s stock prices to drop. See infra Section IV.B.1-4. 1. Inactionable statements Before addressing the particularity requirement in detail, the Court evaluates whether the allegedly false and misleading statements are actionable. The Court holds that many of the statements at issue are either forward-looking statements protected by the PSLRA safe harbor or otherwise inactionable opinions or puffery. a. Forward-looking statements Defendants argue that the bulk of the statements at issue are forward-looking. Mot. at 10- 11. A forward-looking statement is “any statement regarding (1) financial projections, (2) plans and objectives of management for future operations, (3) future economic performance, or (4) the assumptions ‘underlying or related to’ any of these issues.” No. 84 Emp.-Teamster Joint Council Pension Tr. Fund v. Am. W. Holding Corp., 320 F.3d 920, 936 (9th Cir. 2003). A statement that “plainly project[s] expectations for future growth” is still forward-looking even if it is based on past or present circumstances. Police Ret. Sys. of St. Louis v. Intuitive Surgical, Inc., 759 F.3d 1051, 1058 (9th Cir. 2014). However, a statement that goes beyond future projections and instead “provide[s] a concrete description of the past and present state of the [company’s] pipeline” is not forward-looking. Quality, 865 F.3d at 1144. Under the PSLRA, defendants will not be liable if a forward-looking statement is either accompanied by meaningful cautionary language or is made without actual knowledge that the statement is false or misleading. 15 U.S.C. § 78u5(c)(1)(A)(i); see also Wochos v. Tesla, Inc., 985 F.3d 1180, 1190 (9th Cir. 2021). “The PSLRA’s safe harbor is designed to protect companies and their officials from suit when optimistic projections of growth in revenues and earnings are not identified as such and accompanied by meaningful cautionary statements, then the state of mind of the individual making the statement is irrelevant[.]” In re Cutera Sec. Litig., 610 F.3d 1103, 1112 (9th Cir. 2010). If there are no meaningful cautionary statements, however, plaintiffs still need to “allege facts that would create a strong inference” that defendants had actual knowledge of falsity. Id.; see also Quality, 865 F.3d at 1142 (“[T]he safe harbor is not designed to protect companies and their officials when they knowingly make a materially false or misleading statement about current or past facts.”). For mixed statements containing both forward-looking and non-forward- looking portions, courts examine each portion separately. See Quality, 865 F.3d at 1141-42. Many of the allegedly false or misleading statements are either “forward-looking statements made as part of mixed statements, . . . [or] free-standing forward-looking statements.” Id. at 1146. The Court does not list all of the statements but includes the following examples. Free-standing forward-looking statements The following examples are entirely forward-looking statements: • “Against a backdrop of macroeconomic uncertainty, customers are looking to our AI- powered DevSecOps platform to drive efficiencies, increase productivity, and accelerate their pace of innovation. We are poised to make the most of the estimated $40B total addressable market opportunity before us.” SAC ¶ 146. • “We believe that our rapid pace of product innovation and strong customer demand position us to capture a greater share of the estimated $40 billion total addressable market opportunity.” Id. ¶ 160. Forward-looking portions of mixed statements The following examples are forward-looking portions of mixed statements: • “There’s going to be more demand. And more demand, again, means more people entering the fray. . . . [W]e expect the citizen developers . . . to start coding. That code needs to be managed somewhere. And that is in GitLab.” Id. ¶ 152. • “There would be very little impact in FY 2024 and the majority of the impact would come in FY 2025 with all the impact realized in the year of FY 2026.” Id. ¶ 166. • “So I expect we have another quarter, 1.5 quarters to go until we work through the cycle of the new buying patterns.” Id. ¶ 170. • “[Code Suggestions] will be generally available in our December product release.” Id. ¶ 195. These statements are forward-looking because they concern GitLab’s projected financial implications following the Premium tier price increase, expectations on upcoming releases of new AI capabilities and product add-ons, and future customer buying behavior. Plaintiff argues that these statements are not forward-looking because they “refer[] to present or historical facts when discussing past events and/or current conditions.” Opp. at 13. However, the statements do not include specifics or detailed facts. For example, Plaintiff cites to Defendant Sijbrandij’s statement in paragraph 160 of the complaint that “GitLab’s strong quarter is a result of our focus on creating a differentiated and innovative DevSecOps platform and executing on a strong go-to-market motion” as an example of “‘mixed statements’ ineligible for protection.” Id. at 13-14. This statement does not specify how GitLab focused on making the DevSecOps platform “differentiated and innovative,” how GitLab executed “a strong go-to-market motion,” nor how GitLab’s efforts resulted in a strong quarter. See SAC ¶ 160. Instead, Defendant Sijbrandij opines generally that GitLab is advantageously positioned to capture a greater market share in the near future. The Court agrees with Plaintiff that not all of the statements that discuss projections and future expectations are purely forward-looking. For example, Defendants cite to paragraph 195 of the complaint as one of the many example statements that they argue are fundamentally forward- looking. Mot. at 11; see also In re ECOtality, Inc. Sec. Litig., No. 13-03791-SC, 2014 WL 4634280, at[*13] (N.D. Cal. Sep. 16, 2014) (holding that “predictions about the release date of” a product “were forward-looking and protected by the PSLRA safe harbor”). But unlike paragraph 160, paragraph 195 also includes specific facts that paint a picture of GitLab’s past or present circumstances, such as GitLab “already hav[ing] 14 AI features available” to customers, receiving customer feedback “seeing efficiency improvements upwards of 50% with Code Suggestions[,]” the statements does not automatically bar the forward-looking portions from the PSLRA’s safe harbor. See Quality, 865 F.3d at 1146 (analyzing forward-looking portions of mixed statements separately from non-forward-looking portions). b. Cautionary statements Defendants argue that the forward-looking statements are also accompanied by meaningful cautionary language. Mot. at 11-12. The Court agrees. Defendants properly notified investors that “[s]uch forward-looking statements are based upon current expectations and involve risks and uncertainties. . . . [A]ny of the assumptions could prove inaccurate or incorrect and, therefore, there can be no assurance that the results contemplated in the forward-looking statements will be realized.” Ex. 7 at 9; see, e.g., Ex. 1 at 3-4; Ex. 12 at 1. These warnings are sufficient. See Intuitive Surgical, 759 F.3d at 1059 (holding that cautionary language stating “[p]rospective investors are cautioned not to place undue reliance on such forward-looking statements” is sufficient); Cutera, 610 F.3d at 1112 (holding that cautionary language warning that Cutera’s “‘ability to continue increasing sales performance worldwide’ could cause variance in the results” is sufficient). For mixed statements, the cautionary statements go beyond the bare minimum by conveying “appropriate, meaningful information about not only the forward-looking statement[s] but also the non-forward-looking statement[s].” Quality, 865 F.3d at 1148. Defendants disclose a number of risks related to the non-forward-looking portions, such as “loss of market share to [GitLab’s] competitors, . . . a decline in [GitLab’s] customer renewals and expansions, . . . [and the] ability to accurately predict the long-term rate of customer subscription renewals or adoption[.]” Ex. 1 at 4-5; see, e.g., Ex. 2 at 1 (“These non-GAAP measures are not intended to be a substitute for [GitLab’s] GAAP results.”); Ex. 4 at 4-5; Ex. 11 at 1. Plaintiff argues that Defendants’ cautionary statements are not “meaningful” because they are boilerplate warnings “of risks as mere hypotheticals even though they ha[d] already materialized.” Opp. at 15. But Plaintiff has not alleged with particularity that any of the risks had “already materialized” when the forward-looking statements were made. See infra Section (“[Defendant] was aware of a significant likelihood that the risk would materialize[.]”); Khoja, 899 F.3d at 1016 (“[Defendant] allegedly knew already that the ‘new data’ revealed exactly” the inconsistency with interim results.). Therefore, Plaintiff’s argument is unsupported. c. Puffery or corporate optimism Defendants argue that the remaining non-forward-looking statements at issue are puffery or otherwise inactionable. Mot. at 14-20. “‘[V]ague, generalized, and unspecific assertions’ of corporate optimism or statements of ‘mere puffing’ cannot state actionable material misstatements of fact under federal securities laws.” In re Cornerstone Propane Partners, L.P. Sec. Litig., 355 F. Supp. 2d 1069, 1087 (N.D. Cal. 2005) (quoting Glen Holly Ent., Inc. v. Tektronix. Inc., 352 F.3d 367, 379 (9th Cir. 2003)). These types of statements are often forward-looking, not measurable, and not “tethered to facts that a reasonable person would deem important to a securities investment decision.” Id. (quoting City of Monroe Emps. Ret. Sys. v. Bridgestone Corp., 387 F.3d 468, 489 (6th Cir. 2004)); see also Cutera, 610 F.3d at 1111 (“[I]nvestors do not rely on vague statements of optimism like ‘good,’ ‘well-regarded,’ or other feel good monikers.”). By contrast, “[s]tatements by a company that are capable of objective verification are not ‘puffery[.]’” Apollo Grp., 774 F.3d at 606. Likewise, statements of corporate optimism may be actionable “when those statements address specific aspects of a company’s operation that the speaker knows to be performing poorly.” Quality, 865 F.3d at 1143-44 (quoting Warshaw v. Xoma Corp., 74 F.3d 955, 959 (9th Cir. 1996)). Here, some of the statements at issue are puffery or corporate optimism. The Court does not list all of the statements but includes the following examples: • “With AI revolutionizing how companies develop, secure, and operate software, we believe GitLab is positioned as the leading AI-powered DevSecOps platform[.]” SAC ¶ 145. • “In all, we believe that AI will increase the total addressable market for several reasons. . . . We believe that an AI-powered platform focused solely on the developer persona is incomplete.” Id. ¶ 148. • “We believe [the Premium price increase] better aligns price with value for our customers and the investment we made over the past 5 years.” Id. ¶ 163. • “[Privacy and transparency] has allowed customers to feel more comfortable adopting [GitLab’s model.] . . . [W]e’re finding ways to monetize [GitLab’s] product in a way that is best for our customers.” Id. ¶ 188. • “Yes, I think the – our Code Suggestions, I think, is very comparable to market. But I think what’s unique about GitLab is having 14 AI features in the platform available to customers today. I think that’s a big differentiation.” Id. ¶ 203. • “We feel good about our ability to compete.” Id. ¶ 214. Many of these statements include language such as “I think” or “we feel” that expressly indicate corporate optimism or puffery. Other statements do not include such language but are nonetheless “too general to give rise to any particular impression” about GitLab’s AI capabilities, the viability of the Premium tier price increase, customer evaluations of GitLab’s products, or GitLab’s competitiveness in the market. In re Paypal Holdings, Inc. S’holder Deriv. Litig., No. 17-cv-00162-RS, 2018 WL 466527, at *4 (N.D. Cal. Jan. 18, 2018). For example, paragraph 188 contains subjective claims that customers “feel more comfortable” and that GitLab’s monetization method is “best” for customers. See In re Intel Corp. Sec. Litig., No. 18- cv-00507-YGR, 2019 WL 1427660, at *9 (N.D. Cal. Mar. 29, 2019) (“Vague positive statements” are not actionable because “the [c]ourt cannot quantify these statements for their truth or falsity.”). No reasonable investor would rely on these subjective claims, as they do not provide “a concrete description of the past and present” state of affairs. Quality, 865 F.3d at 1144. Having found that many of the challenged statements are inactionable, the Court now turns to address whether Plaintiff plausibly alleges that any statement was false or misleading. 2. Misrepresentations or omissions The PSLRA requires the complaint to “specify each statement alleged to have been misleading” and “the reason or reasons why the statement is misleading[.]” Shenwick, 282 F. Supp. 3d at 1133 (quoting 15 U.S.C. § 78u–4(b)(2)(A)). To be false or misleading, a statement one that actually exists.” Brody v. Transitional Hosp. Corp., 280 F.3d 997, 1006 (9th Cir. 2002); see also Ronconi v. Larkin, 253 F.3d 423, 434 (9th Cir. 2001) (holding that statements were not misleading where allegedly true “circumstances are not inconsistent with the statements”). Here, Defendants allegedly made false or misleading statements relating to four issues: (1) GitLab’s AI capabilities, (2) customers’ evaluations and concerns, (3) GitLab’s intent to compete with GitHub, and (4) the projected financial implications of GitLab’s Premium price increase. See SAC ¶¶ 142, 173. Defendants argue that the complaint provides nothing more than “a boilerplate list of supposed reasons why the misstatement[s] [are] false, without any specifics as to how those reasons apply to the statements at issue.” Mot. at 9. The Court agrees that Plaintiff has not alleged falsity with particularity as to any potentially actionable statement. Plaintiff’s allegations of falsity rely on former employees (“FE”) and confidential witnesses (“CW”), two post-class period events, and various analyst reports. E.g., SAC ¶¶ 109-118, 131-140. But none of these allegations render the challenged statements false or misleading. The Court addresses each category of statements in turn. a. AI capabilities These statements generally describe GitLab’s new AI-powered features, including the number of features offered, the features’ capabilities, their availability to customers, and their potential in the market. See, e.g., id. ¶¶ 152, 161, 178, 195, 203. None of the allegations in the complaint support Plaintiff’s position that these statements were materially different from GitLab’s true AI capabilities. Plaintiff relies on FE1’s account that GitLab’s “AI product line was [not] matching its publicly touted capabilities,” and that a certain executive “exaggerated the Company’s AI capabilities and other GitLab features,” causing turmoil among GitLab’s executives. Id. ¶¶ 117- 118. Plaintiff also relies on FE2’s account that “AI integration was a new feature that was still in the process of being released and trialed,” id. ¶ 110, and FE4’s account that GitLab was in “panic to get onboard the AI train,” id. ¶ 111. However, these three accounts fail to show that Defendants’ statements regarding GitLab’s AI capabilities were false or misleading. See id. ¶ 161 Reviewers] suggests the best reviewer for your code because most of the time that it takes to get something out to market . . . [depends on finding] the right person to review your code.”). These accounts are too generic because they do not identify a single AI feature that was not “matching” its claimed capabilities, nor do they explain how the features were failing to meet expectations. See id. ¶ 117 (“When asked whether the Company’s AI product line was matching its publicly touted capabilities, FE1 responded by stating it was not there yet.”). Plaintiff also fails to allege a single AI capability that was not available at the time Defendants claimed. Instead, Plaintiff relies on CW1’s account that, “because a lot of the customers that utilized GitLab’s self-managed subscriptions are disconnected from the Internet for security reasons, there is no way for these customers to use the Company’s AI-powered features” unless they use GitLab’s own “cloud environment.” Id. ¶ 114. At most, this account supports that certain customers may hesitate or choose not to use GitLab’s AI features, but it does not contradict GitLab’s statements that the features were generally available to customers – including those who work with high-security data. See, e.g., id. ¶ 178 (stating generally that GitLab had “10 AI features usable by customers today”); ¶ 203 (stating generally that GitLab has “14 AI features in the platform available to customers today”). At the motion hearing, Plaintiff argued that even if Defendants’ statements about AI feature availability were literally true, they were misleading. This argument is unavailing. Defendants disclosed that for “many features that interact with customer source code like Code Suggestions and Explain This Vulnerability, [GitLab] use[s] models that reside completely within the GitLab cloud infrastructure[.]” Id. ¶ 76. Thus, the market already knew that customers would need to use GitLab’s cloud environment to use many of GitLab’s AI features. The Court cannot find a plausible instance of misrepresentation or omission in light of Defendants’ disclosure. In sum, Plaintiff fails to plead with particularity why Defendants’ statements regarding GitLab’s AI features, including their availability to customers and their potential benefits, were false or misleading. See, e.g., id. ¶¶ 152, 161, 178.

b. Customer feedback and concerns These statements generally describe customers’ demand for AI features, positive early feedback on some of the features, concerns about AI tools accessing highly sensitive information, and Defendants’ optimistic expectations about customer buying behavior. See, e.g., id. ¶¶ 148, 152, 163, 168, 188, 197, 203. None of the allegations in the complaint contradict Defendants’ statements. Plaintiff relies on FE1’s claim that GitLab’s “AI integration throughout the software development lifecycle was rarely a feature customers were excited about.” Id. ¶ 117. However, FE1’s account fails to show that Defendants’ statements regarding customer feedback were false or misleading. FE1’s account only addresses the frequency at which customers were excited about GitLab’s AI features. This account does not contradict Defendants’ statements addressing customers’ need for AI features in the software development cycle, or positive early feedback for some features that customers gave. See id. ¶ 168 (“[C]ustomers recognize that they need a suite of AI features, and therefore, we’re excited about Duo.”). Plaintiff also relies on FE1’s account that GitLab’s AI features were “hard to sell to customers,” id. ¶ 117, and CW1’s account that customers not being able to use GitLab Duo without GitLab “was a ‘huge barrier’ to sell GitLab Duo,” id. ¶ 115. However, these accounts only address whether certain features were difficult to sell to customers. These accounts do not contradict Defendants’ statements that address positive customer feedback upon using certain AI features, or future optimism about customer buying behavior. See id. ¶ 203 (“Our customers have reported efficiency improvements upwards of 50% with Code Suggestions.”). Plaintiff also relies on FE2’s account that “customers they worked with (primarily large enterprise customers) were only shown video demonstrations of the different possibilities of GitLab’s AI assistance.” Id. ¶ 110. However, FE2’s account only addresses the way in which some customers had exposure to GitLab’s AI product offerings. Even if some customers “were only shown video demonstrations,” id., this account does not contradict Defendants’ statements that customers showed positive feedback toward GitLab’s AI features. The two post-Class Period events that Plaintiff relies on are also insufficient. First, Plaintiff alleges that on July 1, 2024, GitLab began to offer a “‘SMB Premium Tier’ for $19 per user per month, essentially rolling back its April 2023 Premium price increase,” and Duo Pro “for 60 days [f]ree to new and existing customers[.]” Id. ¶¶ 136-137. However, the free trial and the partial rollback does not contradict Defendants’ statements expressing optimism about future customer buying behavior.6 Not only is such puffery inactionable, see supra Section IV.B.1.c, but at most, this event shows that customers were more reluctant than Defendants expected. Plaintiff otherwise does not allege particularized facts to show that Defendants materially misrepresented or omitted information on customer buying behavior. Second, Plaintiff relies on the June 25, 2024 press release showing results from an April 2024 customer survey, which contains statistical data that allegedly “evidenced that customers were reluctant to adopt AI features across all areas of the software development lifecycle[.]” SAC ¶¶ 134-135. However, all of Defendants’ allegedly false and misleading statements are dated before the April 2024 survey. See, e.g., id. ¶ 214. Plaintiff does not allege nor explain how Defendants could have known about this survey’s results when they were making the statements at the time. The survey also does not contradict Defendants’ statements addressing customers’ need for AI features and their positive early feedback. In any event, Defendants did acknowledge customers’ concerns about AI and security. See id. ¶ 197 (“However, in the mid-market and SMB, we see customers continue to be cautious in an uncertain macro environment.”); ¶ 236 (“We found that 79% of respondents [of a June 2023 survey] are concerned about AI tools accessing private information or intellectual property. . . . And that’s why we believe delivering AI beyond just code suggestions is essential.”). Plaintiff otherwise does not plead with particularity facts to plausibly support a material misrepresentation or omission of customer opinions, representative of the general public consensus, that expressly show serious reservations about GitLab and its potential growth in the

6 Elsewhere, the complaint alleges that GitLab “offers a free tier with numerous features to 27 encourage use of GitLab’s DevSecOps Platform.” Id. ¶ 49. Plaintiff offers no reason why market. Nor does Plaintiff “identify particular (and material) facts going to the basis for [Defendants’ opinions] . . . whose omission makes the opinion statement[s] at issue misleading to a reasonable person reading the statement fairly and in context.” Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund, 575 U.S. 175, 194 (2015). c. GitLab’s ability to compete with GitHub These statements generally describe GitLab’s ability to compete with GitHub, including GitLab’s comprehensive incorporation of AI features into security processes compared to GitHub’s narrow focus toward software developers, and GitLab’s ability to win deals against GitHub. See, e.g., SAC ¶¶ 148, 172, 188, 195, 208, 212, 214. None of the allegations in the complaint contradict Defendants’ statements. Plaintiff relies on FE4’s account that GitLab “was not capable of” competing with GitHub, because GitLab tailored its features for enterprise and public sector customers operating in regulatory environments, but “GitHub . . . limit[ed] its influence in certain high security sectors[.]” Id. ¶ 112. However, FE4’s account fails to show that Defendants’ statements regarding GitLab’s ability to compete with GitHub were false or misleading. If anything, GitLab “tailor[ing] its AI- powered features for companies that need security and strong audit trails,” id. ¶ 112, could support Defendants’ statements that GitLab wins deals over GitHub by offering features that GitHub does not. See id. ¶ 188 (“GitLab provides a secure SCM, [] provid[ing] scalability that’s not always there with competition.”). Plaintiff also relies on FE4’s account that “GitHub’s AI pathway has been more focused on the end software developer and making them as productive as possible while GitLab was focused on the enterprise software release process and the totality of the workflow[.]” Id. ¶ 113. However, GitLab’s more comprehensive focus on the “totality of the workflow” compared to GitHub’s allegedly narrower approach supports Defendants’ statements that GitLab was well-positioned against GitHub. Plaintiff also relies on CW2’s account that “the response times and the actual responses that engineers get out of GitLab Duo are not up to par when compared to GitHub Copilot[.]” Id. ¶ 116. However, CW2’s account does not contradict Defendants’ statements because the when compared to GitHub Copilot[.]” Id. ¶ 116. The facts addressed in confidential witness accounts must speak directly to comparisons between GitLab and GitHub that Defendants touted. Finally, Plaintiff relies on CW1’s account that customers not being able to use GitLab Duo without GitLab, whereas “to use Copilot the customer does not need GitHub, . . . was a ‘huge barrier’ to sell GitLab Duo[.]” Id. ¶ 115. However, CW1’s account fails to show how Defendants’ statements “affirmatively create an impression” that GitLab’s ability to compete “differs in a material way from the one that actually exists.” Brody, 280 F.3d at 1006. At most, CW1’s account supports that customers’ inability to use GitLab Duo without GitLab hindered sales compared to GitHub. The account does not contradict Defendants’ statements that GitLab was “winning deals against GitHub” because GitLab’s platform is more comprehensive than GitHub’s platform. SAC ¶ 208. CW1’s account does not directly address to comparisons between GitLab and GitHub that Defendants allegedly made. d. Financial implications of the Premium price increase These statements generally describe financial implications of the Premium price increase, including renewal rates and customer churn, positive results compared to GitLab’s internal forecast, and optimistic future expectations of increased revenue. See, e.g., id. ¶¶ 150, 155, 157, 166, 170, 184, 186, 197, 201. Although Plaintiff attempts to show that Defendants misrepresented the projected financial implications of the Premium price increase, Plaintiff fails to plead with particularity. Essentially, Plaintiff argues that because GitLab allegedly underperformed with respect to certain financial metrics, its general statements about the company’s positive financial outlook were false. Plaintiff focuses on one metric in particular: “seat expansion,” or the growth of individual licenses sold to existing customers. But it is unclear from the complaint and incorporated materials whether GitLab’s net seat expansion was declining. The complaint selectively excerpts a June 4, 2024 report by Barclays Capital Inc. that reflects a decline in seat expansion for new Premium tier users, but the report also states that the “analysis indicates strong Ultimate tier user additions, which also could have impacted a weaker result on our estimates for have been upgrading to higher-tier subscriptions. In any event, the alleged decline in net seat expansion for Premium tier users does not contradict Defendants’ statements that reflect an overall positive financial outlook for the company. See SAC ¶ 166 (“[O]verall bookings [for 2Q24 are] more positive than our internal forecast and churn is less.”). Additionally, Plaintiff does not plausibly allege that Defendants knew and concealed information that was inconsistent with their statements at the time. See id. ¶¶ 150, 155 (stating positive customer churn a month after the Premium tier price increase was implemented).7 The fundamental flaw with Plaintiff’s argument is that it seeks to hold Defendants liable for achieving supposedly suboptimal financial results, without plausibly alleging a material misrepresentation or omission regarding the Premium price increase. See Loos v. Immersion Corp., 762 F.3d 880, 888 (9th Cir. 2014) (“[D]isappointing earnings . . . are merely indicative of poor financial health; they do not tend to suggest that the company had engaged in fraudulent accounting practices.”).8 Therefore, the Court finds that Plaintiff fails to plead with particularity any actionable material misrepresentation or omission. 3. Scienter To adequately allege scienter, plaintiffs need to “state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind.” 15 U.S.C. § 78u- 4(b)(2)(A). The “‘required state of mind’ is a mental state that not only covers ‘intent to deceive, manipulate, or defraud,’ but also ‘deliberate recklessness.’” Quality, 865 F.3d at 1144 (quoting Schueneman v. Arena Pharm., 840 F.3d 698, 705 (9th Cir. 2016)). “[I]n determining whether the pleaded facts give rise to a ‘strong’ inference of scienter, the court must take into account plausible opposing inferences.” Tellabs, 551 U.S. at 323. The “inference of scienter must be

7 At the motion hearing, Plaintiff argued that Robins misrepresented or omitted important information by attributing slower expansion of Premium tier subscriptions to macroeconomic 25 factors, instead of attributing this trend to customers’ price sensitivity. See id. ¶ 170 (Robins observing that customers are “just buying what they need”); ¶ 184 (same); ¶ 197 (Robins stating 26 “we see customers continue to be cautious in an uncertain macro environment”). But the complaint fails to allege any fact that supports a “strong inference” that Robins knew that these 27 statements were false or incomplete. more than merely plausible or reasonable – it must be cogent and at least as compelling as any opposing inference of nonfraudulent intent.” Id. at 314. The court “conducts a dual inquiry when assessing whether the strong inference standard is met: first, it determines whether any one of the plaintiff’s allegations is alone sufficient to give rise to a strong inference of scienter; second, if no individual allegations are sufficient, it conducts a ‘holistic’ review to determine whether the allegations combine to give rise to a strong inference of scienter.” Glazer, 63 F.4th at 766 (citing Zucco Partners, LLC v. Digimarc Corp., 552 F.3d 981, 992 (9th Cir. 2009), as amended (Feb. 10, 2009)). Here, the Court likewise conducts a dual inquiry, beginning with addressing Plaintiff’s scienter theories. First, Plaintiff relies on six FE and CW accounts to allege that Individual Defendants were intentional or reckless in failing to disclose facts regarding delayed AI features, slowed or stalled seat expansion, and weak market demand. See SAC ¶¶ 119, 216. “[A] complaint relying on statements from confidential witnesses must pass two hurdles to satisfy the PSLRA pleading requirements. First, the confidential witnesses whose statements are introduced to establish scienter must be described with sufficient particularity to establish their reliability and personal knowledge. . . . Second, those statements which are reported by confidential witnesses with sufficient reliability and personal knowledge must themselves be indicative of scienter.” Zucco, 552 F.3d at 995. Even assuming that the former employees and confidential witnesses are reliable and have personal knowledge, their accounts do not indicate scienter. Plaintiff relies on FE1’s, FE2’s, FE4’s, CW1’s, and CW2’s statements mentioned above, see supra Section IV.B.2, as well as FE3’s account that senior executives attended company meetings discussing GitLab’s AI product offerings and the company’s “horizon.” SAC ¶ 218. Plaintiff also relies on FE4’s account that “GitLab leadership was regularly kept in the loop” regarding AI product development, which “was a topic of every meeting that leadership was involved with[.]” Id. ¶ 219. These generic allegations fail to demonstrate that Individual Defendants knowingly made false or misleading statements. At most, these allegations suggest that Individual Defendants were GitLab’s business operations and financial condition during the Class Period.” Id. ¶ 230. However, “generalized claims about corporate knowledge are not sufficient to create a strong inference of scienter[.]” Zucco, 552 F.3d at 998. As Defendants correctly argue, “Plaintiff’s effort to conflate knowledge of the Company’s business with knowledge of falsity is no substitute for particularized facts[.]” Mot. at 22-23. Even if Individual Defendants had knowledge of all of the company’s operations, Plaintiff has not identified any particularized facts that Individual Defendants knew that would undermine the truth of any challenged statement. See supra Section IV.B.2. Second, Plaintiff relies on a core operations theory to argue scienter. See SAC ¶¶ 220-228, 231-239. An individual defendant’s role in a company may show scienter if: (1) “they are particular and suggest that defendants had actual access to the disputed information,” (2) they, along with other allegations “when read together, raise an inference of scienter that is ‘cogent and compelling, thus strong in light of other explanations[,]’” or (3) “in rare circumstances where the nature of the relevant fact is of such prominence that it would be ‘absurd’ to suggest that management was without knowledge of the matter.” S. Ferry LP, No. 2 v. Killinger, 542 F.3d 776, 785-86 (9th Cir. 2008) (quoting Tellabs, 551 U.S. at 323.). Here, Plaintiff’s core operations theory at most shows that Individual Defendants had access to core operations information. Access to information, by itself, does not establish that Individual Defendants knew their statements were false or misleading. See Splash, 160 F. Supp. 2d at 1079-81 (holding that boilerplate allegations of defendants’ access to internal information, without particularized facts, are insufficient to show scienter). Plaintiff argues that it would be “absurd” to suggest that the Individual Defendants lacked knowledge about customer responses to GitLab’s price change and the company’s AI product offering. Opp. at 21. But Plaintiff has not identified any relevant fact that contradicts Defendants’ statements, much less any fact “of such prominence” that the Individual Defendants must have known it. Ferry, 542 F.3d at 786. “Where defendants make cheerful predictions that do not come to pass, plaintiffs may not argue, based only on defendants’ prominent positions in the company, that they ought to have known better.” Berson v. Applied Third, Plaintiff suggests that the “suspicious” timing of executive departures from the company indicates scienter. SAC ¶¶ 240-248. Plaintiff relies on FE1’s account that “Ms. Kramer’s tendency to exaggerate the Company’s AI capabilities and other GitLab features caused turmoil amongst the upper ranks at GitLab[]” and numerous vice presidents ultimately left GitLab as a result. Id. ¶¶ 118, 248. Plaintiff argues that the short-term appointments and departures of former high-ranking employees in close proximity to the Class Period are suspicious enough to strongly imply scienter. See id. ¶¶ 240-248. However, “proximate resignations of high-ranking officers or directors do not alone support scienter[.]” In re UTStarcom, Inc. Sec. Litig., 617 F. Supp. 2d 964, 975-76 (N.D. Cal. 2009). Here, the Court cannot solely rely on the seemingly suspicious timing of executive departures to infer that Defendants acted with scienter. Finally, upon a holistic review, the Court holds that Plaintiff’s allegations together do not “give rise to a strong inference of scienter” for the reasons discussed above. Glazer, 63 F.4th at 766. Although the opposition correctly points out that Plaintiff does not need to allege Individual Defendants gained financial benefits to show scienter, the argument that “Defendants offer no competing non-fraudulent inference” is misplaced. Opp. at 21-22. Plaintiff has the ultimate burden of plausibly alleging that “the inference of scienter [is] cogent and at least as compelling as any opposing inference one could draw from the facts alleged.” Tellabs, 551 U.S. at 324. In many instances, Plaintiff’s allegations do not support an inference of scienter at all. See, e.g., SAC ¶¶ 134-141 (discussing information learned after challenged statements were made). In other instances, Plaintiff’s allegations support a more compelling inference that Defendants disclosed material information to investors. Compare id. ¶ 134 (alleging that “40% of individual contributors cited concerns about privacy and data security as a top obstacle to using AI”), with ¶ 236 (Sijbrandij stating earlier that customers are concerned about security and privacy). Therefore, the Court finds that Plaintiff fails to plead scienter with particularity. 4. Loss causation “To establish loss causation in a fraud-on-the-market case, the plaintiff must show that after purchasing her shares and before selling, the following occurred: (1) ‘the truth became or eliminated.” In re BofI Holding, Inc. Sec. Litig., 977 F.3d 781, 791 (9th Cir. 2020) (quoting Dura Pharms., Inc. v. Broudo, 544 U.S. 336, 347 (2005)). Plaintiffs commonly seek to prove loss causation by identifying one or more corrective disclosures. See id. at 790. A corrective disclosure must reveal “new facts that, taken as true, render some aspect of the defendant’s prior statements false and misleading”; it “need not precisely mirror the earlier misrepresentation.” Id. (first citing Pub. Emps. Ret. Sys. of Miss. v. Amedisys, Inc., 769 F.3d 313, 321-22 (5th Cir. 2014), then quoting In re Williams Sec. Litig. – WCG Subclass, 558 F.3d 1130, 1140 (10th Cir. 2009)). Identifying a corrective disclosure is just one way to establish that a fraud was revealed to the market. See In re Genius Brands Int’l, Inc. Sec. Litig., 97 F.4th 1171, 1183-84 (9th Cir. 2024). Regardless of the method chosen, Plaintiff must plausibly allege that “the defendant’s misstatement, as opposed to some other fact, foreseeably caused the plaintiff’s loss.” Id. at 1183 (quoting Mineworker’s Pension Scheme v. First Solar Inc., 881 F.3d 750, 753 (9th Cir. 2018)). Plaintiff fails to plead with particularity what new information the 4Q24 and 1Q25 corrective disclosures revealed. Defendants correctly point out that the 4Q24 and 1Q25 disclosures “said nothing to suggest improprieties in connection with any of [GitLab’s] prior statements, much less did they reveal a fraud.” Mot. at 24 (emphases omitted). The only new information that the 1Q25 disclosure reveals is the completed SSP analysis resulting in an estimated $4 million headwind. SAC ¶ 11. However, Defendants had already informed investors in the prior 4Q24 disclosure that GitLab had not finished its SSP analysis. Id. ¶ 8. Although Plaintiff correctly notes that “[a] corrective disclosure [] need not ‘precisely mirror’ the misrepresentation,” Opp. at 23, Plaintiff fails to elaborate how the market “understood” the $4 million SSP headwind as a “revelation of fraud.” First Solar, 881 F.3d at 753-54. Nor does Plaintiff otherwise show with particularity how Individual Defendants’ statements, “as opposed to some other fact, foreseeably caused the plaintiff's loss.” Lloyd v. CVB Fin. Corp., 811 F.3d 1200, 1210 (9th Cir. 2016). Plaintiff claims that GitLab’s alleged lower-than-expected 21% growth y/y in ARR “revealed that GitLab had experienced a decline in net seat expansion,” which Defendants allegedly concealed. SAC ¶ 261. However, Plaintiff seems to conflate two different metrics.9 Even assuming that the suboptimal revenue growth is accurate, the Court cannot infer loss causation from loss itself, or from the mere failure to meet a financial projection. See Dura Pharms., 544 U.S. at 343 (“To ‘touch upon’ a loss is not to cause a loss[.]”); In re Oracle Corp. Sec. Litig., 627 F.3d 376, 392 (9th Cir. 2010) (“Loss causation requires more than an earnings miss.”). Fundamentally, Plaintiff fails to allege that the “market understood” GitLab’s supposed financial underperformance as “a revelation of fraud.” Genius Brands, 97 F.4th at 1184. Therefore, the Court finds that Plaintiff fails to plead loss causation with particularity. In sum, because Plaintiff fails to plead the material misrepresentation or omission, scienter, and loss causation elements, Defendants’ motion to dismiss the Section 10(b) and SEC Rule 10b-5 claim is GRANTED. C. Section 20(a) Claim Section 20(a) states: “Every person who, directly or indirectly, controls any person liable under any provision of this chapter or of any rule or regulation thereunder shall also be liable jointly and severally with and to the same extent as such controlled person to any person to whom such controlled person is liable[.]” 15 U.S.C. § 78t(a). To state a claim for control person liability under Section 20(a), plaintiffs must allege “(1) a primary violation of federal securities laws[,] . . . and (2) that the defendant exercised actual power or control over the primary violator[.]” Howard v. Everex Sys., 228 F.3d 1057, 1065 (9th Cir. 2000). “If [p]laintiffs fail to plead a claim for securities fraud under [Section] 10(b) and Rule 10b-5, the [Section] 20(a) claim fails as well.” Mulligan v. Impax Lab’ys, Inc., 36 F. Supp. 3d 942, 956 (N.D. Cal. 2014). For the reasons discussed above, Plaintiff fails to plead a primary violation of federal securities law. See supra Section IV.B. Therefore, Plaintiff also fails to plead a violation of Section 20(a). Defendants’ motion to dismiss this claim is GRANTED.

9 GitLab reported a 33% growth y/y in ARR, 7 points above the expected 26% growth y/y from the previous 1Q25 guidance announced in the 4Q24 disclosure. Ex. 19 at 1. Plaintiff alleges that 27 GitLab “land[ed] 5 points below consensus growth expectations,” but appears to be relying on a different metric – GitLab’s growth in number of customers with more than $5,000 of ARR. D. Dismissal is with Leave to Amend The Court grants leave to amend because this is the Court’s first ruling on the legal sufficiency of Plaintiffs’ allegations. See Lopez, 203 F.3d at 1127 (holding that the “court should || grant leave to amend . .. unless it determines that the pleading could not possibly be cured by the || allegation of other facts” (quoting Doe, 58 F.3d at 497)).!° Although the Court grants leave to || amend, the Court may dismiss Plaintiffs’ claims with prejudice if Plaintiffs’ amended complaint || fails to plausibly state a claim. See Zucco, 552 F.3d at 1007 (holding that failure to correct || pleading deficiencies after dismissal is a “strong indication” that further amendment would be futile); see also Salameh y. Tarsadia Hotel, 726 F.3d 1124, 1133 (9th Cir. 2013) (“A district || court’s discretion to deny leave to amend is ‘particularly broad’ where the plaintiff has previously amended.” (quoting Sisseton-Wahpeton Sioux Tribe v. United States, 90 F.3d 351, 355 (9th Cir. 2 1996))).

13 || v. CONCLUSION 14 For the foregoing reasons, Defendants’ motion to dismiss is GRANTED and the second 15 || amended complaint is dismissed with leave to amend. Plaintiff shall file an amended complaint 16 || within 30 days of this Order. Upon filing the third amended complaint, Plaintiff shall also file a 2 17 redlined version comparing it to the second amended complaint. 18 IT IS SO ORDERED. 19 Dated: August 14, 2025 20 21 umik.Lee United States District Judge 23 24 25 26 27 ‘0 Tn support of the request for leave to amend, Plaintiff cites Osher v. JNI Corp., 183 F. App’x 604 (9th Cir. 2006). See Opp. at 25. Pursuant to Ninth Circuit Rule 36-3(c), Plaintiff may not cite 28 Osher as legal support because it is an unpublished order that issued before January 1, 2007.