Dependency list Ultimate All offerings

Version history

Use the dependency list to review your project or group’s dependencies and key details about those dependencies, including their known vulnerabilities. This list is a collection of dependencies in your project, including existing and new findings. This information is sometimes referred to as a Software Bill of Materials, SBOM, or BOM.

For an overview, see Project Dependency.

Prerequisites

To view your project’s dependencies, ensure you meet the following requirements:

View project dependencies

To view the dependencies of a project or all projects in a group:

  1. On the left sidebar, select Search or go to and find your project or group.
  2. Select Secure > Dependency list.

Details of each dependency are listed, sorted by decreasing severity of vulnerabilities (if any). You can sort the list instead by component name or packager.

Field Description
Component The dependency’s name and version.
Packager The packager used to install the dependency.
Location For system dependencies, this lists the image that was scanned. For application dependencies, this shows a link to the packager-specific lock file in your project that declared the dependency. It also shows the dependency path to a top-level dependency, if any, and if supported.
License1 Links to dependency’s software licenses. A warning badge that includes the number of vulnerabilities detected in the dependency.
Projects2 Links to the project with the dependency. If multiple projects have the same dependency, the total number of these projects is shown. To go to a project with this dependency, select the Projects number, then search for and select its name. The project search feature is supported only on groups that have up to 600 occurrences in their group hierarchy.
Footnotes:
  1. Project-level only.
  2. Group-level only.

Dependency list

Filter dependency list

Introduced in GitLab 16.7 with a flag named group_level_dependencies_filtering. Disabled by default.

On self-managed GitLab, by default this feature is not available. To make it available, an administrator can enable the feature flag named group_level_dependencies_filtering. On GitLab.com, this feature is available but can be configured by GitLab.com administrators only.

In the group-level dependency list you can filter by:

  • Project
  • License

To filter the dependency list:

  1. On the left sidebar, at the top, select Search GitLab () to find your project or group.
  2. Select Secure > Dependency list.
  3. Select the filter bar.
  4. Select a filter, then from the dropdown list select one or more criteria. To close the dropdown list, select outside of it. To add more filters, repeat this step.
  5. To apply the selected filters, press Enter.

The dependency list shows only dependencies that match your filters.

Vulnerabilities

If a dependency has known vulnerabilities, view them by selecting the arrow next to the dependency’s name or the badge that indicates how many known vulnerabilities exist. For each vulnerability, its severity and description appears below it. To view more details of a vulnerability, select the vulnerability’s description. The vulnerability’s details page is opened.

Dependency paths

The dependency list shows the path between a dependency and a top-level dependency it’s connected to, if any. Multiple paths may connect a transient dependency to top-level dependencies, but the user interface shows only one of the shortest paths.

note
The dependency path is only displayed for dependencies that have vulnerabilities.

Dependency path

Dependency paths are supported for the following package managers:

Licenses

If the Dependency Scanning CI job is configured, discovered licenses are displayed on this page.

Download the dependency list

You can download the full list of dependencies and their details in JSON format. The dependency list shows only the results of the last successful pipeline that ran on the default branch.

To download the dependency list:

  1. On the left sidebar, select Search or go to and find your project or group.
  2. Select Secure > Dependency list.
  3. Select Export.