Dependency Scanning - Advanced Security Testing (HD)
The Dependency Scanning feature can automatically find security vulnerabilities in your software dependencies while you’re developing and testing your applications. For example, dependency scanning lets you know if your application uses an external (open source) library that is known to be vulnerable. You can then take action to protect your application.
Dependency Scanning is often considered part of Software Composition Analysis (SCA). SCA can contain aspects of inspecting the items your code uses. These items typically include application and system dependencies that are almost always imported from external sources, rather than sourced from items you wrote yourself.
If you’re using GitLab CI/CD, you can use dependency scanning to analyze your dependencies for known vulnerabilities. GitLab scans all dependencies, including transitive dependencies (also known as nested dependencies). You can take advantage of dependency scanning by either:
Including the dependency scanning template in your existing .gitlab-ci.yml file.
Implicitly using the auto dependency scanning provided by Auto DevOps.
GitLab checks the dependency scanning report, compares the found vulnerabilities between the source and target branches, and shows the information on the merge request. The results are sorted by the severity of the vulnerability.
Read more in our docs: https://docs.gitlab.com/ee/user/appli...