| type | stage | group | info |
|---|---|---|---|
reference, howto |
Secure |
Composition Analysis |
To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments |
Introduced in GitLab Ultimate 12.0.
The dependency list allows you to see your project's dependencies, and key details about them, including their known vulnerabilities. To see it, navigate to Security & Compliance > Dependency List in your project's sidebar. This information is sometimes referred to as a Software Bill of Materials or SBoM / BOM.
- The Dependency Scanning CI job must be configured for your project.
- Your project uses at least one of the languages and package managers supported by Gemnasium.
Dependencies are displayed with the following information:
| Field | Description |
|---|---|
| Component | The dependency's name and version |
| Packager | The packager used to install the dependency |
| Location | A link to the packager-specific lock file in your project that declared the dependency. It also shows the dependency path to a top-level dependency, if any, and if supported. |
| License | Links to dependency's software licenses |
Dependencies shown are initially sorted by the severity of their known vulnerabilities, if any. They can also be sorted by name or by the packager that installed them.
If a dependency has known vulnerabilities, you can view them by clicking the arrow next to the dependency's name or the badge that indicates how many known vulnerabilities exist. For each vulnerability, its severity and description then appears below it.
The dependency list shows the path between a dependency and a top-level dependency it's connected to, if any. There are many possible paths connecting a transient dependency to top-level dependencies, but the UI only shows one of the shortest paths.
Dependency Paths are supported for the following package managers:
Introduced in GitLab Ultimate 12.3.
If the License Compliance CI job is configured, the discovered licenses are displayed on this page.
Your project's full list of dependencies and their details can be downloaded in
JSON format by clicking on the download button.