Dependency List
Introduced in GitLab Ultimate 12.0.
The Dependency list allows you to see your project’s dependencies, and key details about them, including their known vulnerabilities. To see it, navigate to Security & Compliance > Dependency List in your project’s sidebar. This information is sometimes referred to as a Software Bill of Materials or SBoM / BOM.
Requirements
- The Dependency Scanning CI job must be configured for your project.
- Your project uses at least one of the languages and package managers supported by Gemnasium.
Viewing dependencies
Dependencies are displayed with the following information:
Field | Description |
---|---|
Component | The dependency’s name and version |
Packager | The packager used to install the depedency |
Location | A link to the packager-specific lockfile in your project that declared the dependency |
License | Links to dependency’s software licenses |
Dependencies shown are initially sorted by the severity of their known vulnerabilities, if any. They can also be sorted by name or by the packager that installed them.
Vulnerabilities
If a dependency has known vulnerabilities, you can view them by clicking the arrow next to the dependency’s name or the badge that indicates how many known vulnerabilities exist. For each vulnerability, its severity and description then appears below it.
Licenses
Introduced in GitLab Ultimate 12.3.
If the License Compliance CI job is configured, the discovered licenses will be displayed on this page.
Downloading the Dependency List
Your project’s full list of dependencies and their details can be downloaded in
JSON
format by clicking on the download button.
Help and feedback
If there's something you don't like about this feature
To propose functionality that GitLab does not yet offer
To further help GitLab in shaping new features
If you didn't find what you were looking for
If you want help with something very specific to your use case, and can use some community support
POST ON GITLAB FORUM
If you have problems setting up or using this feature (depending on your GitLab subscription)
REQUEST SUPPORT
To view all GitLab tiers and features or to upgrade
If you want to try all features available in GitLab.com
If you want to try all features available in GitLab self-managed
If you spot an error or a need for improvement and would like to fix it yourself in a merge request
EDIT THIS PAGE
If you would like to suggest an improvement to this doc