Dependency list (ULTIMATE ALL)
- System dependencies introduced in GitLab 14.6.
- Group-level dependency list introduced in GitLab 16.2 with a flag named
group_level_dependencies. Disabled by default.
Use the dependency list to review your project or group's dependencies and key details about those dependencies, including their known vulnerabilities. It is a collection of dependencies in your project, including existing and new findings.
For an overview, see Project Dependency.
To see the dependency list, go to your project or group and select Secure > Dependency list.
This information is sometimes referred to as a Software Bill of Materials, SBOM, or BOM.
Prerequisites
To view your project's dependencies, ensure you meet the following requirements:
- The Dependency Scanning or Container Scanning CI job must be configured for your project.
- Your project uses at least one of the languages and package managers supported by Gemnasium.
- A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail.
View a project's dependencies
GitLab displays dependencies with the following information:
| Field | Description |
|---|---|
| Component | The dependency's name and version. |
| Packager | The packager used to install the dependency. |
| Location | For system dependencies, this lists the image that was scanned. For application dependencies, this shows a link to the packager-specific lock file in your project that declared the dependency. It also shows the dependency path to a top-level dependency, if any, and if supported. |
| License | Links to dependency's software licenses. |
Displayed dependencies are initially sorted by the severity of their known vulnerabilities, if any. They can also be sorted by name or by the packager that installed them.
Vulnerabilities
If a dependency has known vulnerabilities, view them by selecting the arrow next to the dependency's name or the badge that indicates how many known vulnerabilities exist. For each vulnerability, its severity and description appears below it. To view more details of a vulnerability, select the vulnerability's description. The vulnerability's details page is opened.
Dependency paths
The dependency list shows the path between a dependency and a top-level dependency it's connected to, if any. There are many possible paths connecting a transient dependency to top-level dependencies, but the user interface shows only one of the shortest paths.
NOTE: The dependency path is only displayed for dependencies that have vulnerabilities.
Dependency paths are supported for the following package managers:
Licenses
Introduced in GitLab 12.3.
If the Dependency Scanning CI job is configured, discovered licenses are displayed on this page.
View a group's dependencies
FLAG:
On self-managed GitLab, and GitLab.com the feature is disabled by default. To show the feature, an administrator can enable the feature flag named group_level_dependencies.
GitLab displays dependencies with the following information:
| Field | Description |
|---|---|
| Component | The dependency's name and version. |
| Packager | The packager used to install the dependency. |
| Location | For operating system dependencies, this lists the image that was scanned. For application dependencies, this shows a link to the packager-specific lock file in your project that declared the dependency. It also shows the dependency path to a top-level dependency, if any, and if supported. If there are multiple locations, the total number of locations is displayed. |
| Projects | Links to the project related to the dependency. If there are multiple projects, the total number of projects is displayed. |
Displayed dependencies are initially sorted by packager. They can also be sorted by name.
Downloading the dependency list
You can download the full list of dependencies and their details in
JSON format.
In the UI
You can download your group's or project's list of dependencies and their details in JSON format by selecting the Export button. The dependency list only shows the results of the last successful pipeline to run on the default branch.
Using the API
You can download your project's list of dependencies using the API. Note this only provides the dependencies identified by the Gemnasium family of analyzers and not any other of the GitLab dependency analyzers.