Continuous Vulnerability Scanning

Tier: Ultimate
Offering: GitLab.com, Self-managed, GitLab Dedicated
History

Continuous Vulnerability Scanning detects new vulnerabilities outside a pipeline. Your projects are automatically scanned whenever advisories are added to the GitLab Advisory Database, or Trivy DB. Projects that depend on the affected components have new vulnerabilities automatically created.

Continuous Vulnerability Scanning detects vulnerabilities in the latest CycloneDX SBOM reports for the default branch. Dependency Scanning and Container Scanning are used to generate these reports.

Supported component types

Components with the following PURL types are supported:

  • composer
  • conan
  • deb
  • gem
  • golang
  • maven
  • npm
  • nuget
  • pypi

Work to support apk and rpm PURL types is tracked in issue 428703.

Configuration

To enable Continuous Vulnerability Scanning:

Running in an offline environment

For self-managed GitLab instances in an environment with limited, restricted, or intermittent access to external resources through the internet, some adjustments are required to successfully scan CycloneDX reports for vulnerabilities. For more information, see the offline quick start guide.

Supported languages and package managers

The supported files and versions are the ones supported by Dependency Scanning.

Go pseudo versions are not supported. A project dependency that references a Go pseudo version is never considered as affected. This might result in false negatives.

Checking new vulnerabilities

New vulnerabilities detected by Continuous Vulnerability Scanning are visible on the Vulnerability Report. However, they are not listed on the Dependency List or in the pipeline where the affected SBOM component was detected.

After an advisory is added to the GitLab Advisory Database or Trivy DB, it might take a few hours before the corresponding vulnerabilities are added to your projects.

Contributing to the vulnerability database

To find a vulnerability, you can search the GitLab Advisory Database. You can also submit new vulnerabilities.