Dependency list
- Tier: Ultimate
- Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated
Use the dependency list to review your project or group’s dependencies and key details about those dependencies, including their known vulnerabilities. This list is a collection of dependencies in your project, including existing and new findings. This information is sometimes referred to as a Software Bill of Materials, SBOM, or BOM.
For an overview, see Project Dependency.
Prerequisites
To list your project’s dependencies the SBOM document must:
- Comply with the CycloneDX specification version
1.4
,1.5
, or1.6
. Online validator available on CycloneDX Web Tool. - Be uploaded as a CI/CD artifact report from a successful pipeline on the default branch.
Although this is not mandatory for populating the dependency list, the SBOM document must include and comply with the GitLab CycloneDX property taxonomy to provide some properties and to enable some security features.
GitLab already generates this document when the following requirements are met:
- The Dependency Scanning or Container Scanning CI job must be configured for your project.
- Your project uses at least one of the languages and package managers supported by Gemnasium.
- A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail.
View project dependencies
To view the dependencies of a project or all projects in a group:
- On the left sidebar, select Search or go to and find your project or group.
- Select Secure > Dependency list.
Details of each dependency are listed, sorted by decreasing severity of vulnerabilities (if any). You can sort the list instead by component name, packager, or license.
Field | Description |
---|---|
Component | The dependency’s name and version. |
Packager | The packager used to install the dependency. |
Location | For system dependencies, this lists the image that was scanned. For application dependencies, this shows a link to the packager-specific lock file in your project that declared the dependency. It also shows the direct dependents of the dependency, if any, and if supported. |
License (for projects only) | Links to dependency’s software licenses. A warning badge that includes the number of vulnerabilities detected in the dependency. |
Projects (for groups only) | Links to the project with the dependency. If multiple projects have the same dependency, the total number of these projects is shown. To go to a project with this dependency, select the Projects number, then search for and select its name. The project search feature is supported only on groups that have up to 600 occurrences in their group hierarchy. |
Filter dependency list
You can filter the dependency list to focus on only a subset of dependencies. The dependency list is available for groups and projects.
For groups, you can filter by:
- Project
- License
- Components
For projects, you can filter by:
- Components
To filter the dependency list:
- On the left sidebar, at the top, select Search GitLab ( ) to find your group or project.
- Select Secure > Dependency list.
- Select the filter bar.
- Select a filter, then from the dropdown list select one or more criteria. To close the dropdown list, select outside of it. To add more filters, repeat this step.
- To apply the selected filters, press Enter.
The dependency list shows only dependencies that match your filters.
Vulnerabilities
The availability of support for vulnerabilities associated with SBOM-based dependency scanning is controlled by a feature flag. For more information, see the history.
If a dependency has known vulnerabilities, view them by selecting the arrow next to the dependency’s name or the badge that indicates how many known vulnerabilities exist. For each vulnerability, its severity and description appears below it. To view more details of a vulnerability, select the vulnerability’s description. The vulnerability’s details page is opened.
Dependency paths
The dependency list shows the direct dependents of a listed component if the component is transient and belongs to any supported package manager.
The dependency path is only displayed for dependencies that have vulnerabilities.
Dependency paths are supported for the following package managers:
Dependency paths are supported for the following package managers only when using the dependency-scanning
component:
Licenses
If the Dependency Scanning CI job is configured, discovered licenses are displayed on this page.
Download the dependency list
You can download the full list of dependencies and their details in JSON format. The dependency list shows only the results of the last successful pipeline that ran on the default branch.
To download the dependency list:
- On the left sidebar, select Search or go to and find your project or group.
- Select Secure > Dependency list.
- Select Export.
Troubleshooting
License appears as ‘unknown’
The license for a specific dependency might show up as unknown
for a few possible reasons. This section describes how to determine whether a specific dependency’s license shows up as unknown
for a known reason.
License is ‘unknown’ upstream
Check the license specified for the dependency upstream:
- For C/C++ packages, check Conancenter.
- For npm packages, check npmjs.com.
- For Python packages, check PyPI.
- For NuGet packages, check Nuget.
- For Go packages, check pkg.go.dev.
If the license appears as unknown
upstream, it is expected that GitLab will show the License for that dependency to be unknown
as well.
License includes SPDX license expression
SPDX license expressions are not supported. Dependencies with SPDX license expressions appear with a License that is unknown
. An example of an SPDX license expression is (MIT OR CC0-1.0)
. Read more in issue 336878.
Package version not in Package Metadata DB
The specific version of the dependency package must exist in the Package Metadata Database. If it doesn’t, the License for that dependency appears as unknown
. Read more in issue 440218 about Go modules.
Package name contains special characters
If the name of the dependency package contains a hyphen (-
) the License may appear as unknown
. This can happen when packages are added manually to requirements.txt
or when pip-compile
is used. This happens because GitLab does not normalize Python package names in accordance with the guidance on normalized names in PEP 503 when ingesting information about dependencies. Read more in issue 440391.
Docs
Edit this page to fix an error or add an improvement in a merge request.
Create an issue to suggest an improvement to this page.
Product
Create an issue if there's something you don't like about this feature.
Propose functionality by submitting a feature request.
Feature availability and product trials
View pricing to see all GitLab tiers and features, or to upgrade.
Try GitLab for free with access to all features for 30 days.
Get help
If you didn't find what you were looking for, search the docs.
If you want help with something specific and could use community support, post on the GitLab forum.
For problems setting up or using this feature (depending on your GitLab subscription).
Request support