Continuous vulnerability scanning

Continuous vulnerability scanning (CVS) is the capability that lets GitLab create vulnerability records without requiring a new CI/CD pipeline to run. When a new security advisory is published or updated, GitLab compares the advisory against the components already recorded for your projects and creates vulnerability records for any matches.

CVS relies on a CycloneDX SBOM report stored on the default branch to know which components your project uses. To produce this SBOM, a dependency scanning job must run at least once on the default branch. From then on, CVS detects newly published advisories against those components automatically, with no further pipeline runs required. When your application dependencies change, a new pipeline must run on the default branch to refresh the SBOM so CVS can evaluate the updated set of components. In most projects this happens as part of the regular workflow, because changing dependencies typically involves a code change that already triggers a pipeline.

In contrast to CI-based security scans, continuous vulnerability scanning is executed through background jobs (Sidekiq) rather than CI pipelines and no Security report artifacts are generated.

Merge request security reports

The security widget of a merge request compares the security report artifacts of the merge request’s pipeline against the security report artifacts of the latest pipeline on the target branch. Because CVS does not generate security report artifacts, the vulnerabilities CVS creates on the default branch are not part of that comparison.

As a result, when a pipeline in a merge request detects a vulnerability that CVS has already created on the default branch, the merge request reports that vulnerability as newly detected, even when the affected component is unchanged. After the next pipeline runs on the default branch, the security report artifacts of the target branch include the vulnerability, and later merge requests no longer report it as newly detected.

The limitation affects the merge request comparison only. On the default branch, the vulnerability report shows the vulnerability from the moment CVS creates it.

Supported features

Continuous vulnerability scanning is available for the following security scans:

• Continuous dependency scanning for application dependencies.
• Continuous container scanning for container image packages.