Dependency Scanning [ULTIMATE]
Introduced in [GitLab Ultimate][ee] 10.7.
If you are using GitLab CI/CD, you can analyze your dependencies for known vulnerabilities using Dependency Scanning.
Going a step further, GitLab can show the vulnerability list right in the merge request widget area.
It helps you automatically find security vulnerabilities in your dependencies while you are developing and testing your applications. E.g. your application is using an external (open source) library which is known to be vulnerable.
Supported languages and dependency managers
The following languages and dependency managers are supported.
|Language (package managers)||Scan tool|
|Ruby (gem)||gemnasium, bundler-audit|
Some scanners require to send a list of project dependencies to GitLab central servers to check for vulnerabilities. To learn more about this or to disable it please check GitLab Dependency Scanning documentation.
How it works
First of all, you need to define a job in your
.gitlab-ci.yml file that generates the
Dependency Scanning report artifact.
For more information on how the Dependency Scanning job should look like, check the
example on Dependency Scanning with GitLab CI/CD.
GitLab then checks this report, compares the found vulnerabilities between the source and target branches, and shows the information right on the merge request.