TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

FIPS Package Dependency Management

28 posts · May 2019 – Jul 2026

What this trail covers

GitLab enhances its DevSecOps platform with AI/ML capabilities, including the introduction of GPU-enabled runners on GitLab.com. These runners accelerate ModelOps and HPC workloads, such as training and deploying large language models (LLMs). The post details how to use these runners, including selecting appropriate Docker images with NVIDIA CUDA drivers and verifying GPU functionality. It provides examples for Python model training and scientific simulations, and a more advanced example of AI-assisted development. Additionally, FIPS packages are evolving to use distribution-provided curl and OpenSSL for improved security and maintainability, shifting responsibility for curl security updates to the customer.

All GitLab trails
  1. When a version bump breaks your build, GitLab fixes itThis post introduces agentic breaking change resolution as an enhancement to Dependency Scanning Auto-Remediation. It details how the GitLab Duo Agent Platform analyzes pipeline errors, dependency changelogs, and code usage to automatically commit fixes within the same merge request when a dependency version bump breaks the build. It also outlines supported ecosystems, planned additions, built-in safeguards, and configuration options for this new capability.
  2. Full security scanner coverage of your codebase in minutesIntroduces security configuration profiles as a centralized UI-based mechanism to manage SAST, dependency scanning, and secret detection scanners across projects. Defines default profiles with recommended scan triggers (merge request pipelines, branch pipelines for default branch) and adds push protection for secret detection. Enables bulk application of profiles from the security inventory.
  3. Reduce supply chain risk with SBOM-based dependency scanningIntroduces SBOM-based dependency scanning as a generally available feature, moving beyond traditional CVE matching. This new analyzer catalogs dependencies in CycloneDX format, traces transitive dependencies, identifies reachable vulnerabilities, and supports continuous scanning. It also introduces security configuration profiles and scan execution policies for centralized management and enforcement of dependency scanning across projects.
  4. curl removed from Omnibus-GitLab FIPS packages in 19.0Starting with Omnibus-GitLab 19.0, FIPS packages will no longer include a GitLab-built version of curl. Instead, they will use the curl package provided by the customer's Linux distribution, aligning with the existing model for OpenSSL. This change is due to curl 8.18.0 deprecating compilation against OpenSSL 1.x. GitLab will no longer be responsible for shipping security updates to curl in FIPS packages; customers must keep their OS's curl up to date. Scanner findings for curl will now reflect the host OS package.
  5. Prepare your pipeline for AI-discovered zero-daysThis post introduces the concept of AI-discovered zero-day vulnerabilities and the urgent need to integrate security enforcement directly into the CI/CD pipeline. It details how AI can be used for automated triage, reachability analysis, exploitability assessment, and proposing code fixes. The proposed workflow emphasizes policy enforcement at the merge request level, catching issues in the IDE, and providing auditable evidence of security governance for all changes, including AI-generated ones.
  7. GitLab uncovers Bittensor theft campaign via PyPIThis post details the discovery and analysis of a cryptocurrency theft campaign targeting the Bittensor ecosystem through typosquatted Python packages on PyPI. It highlights the use of modified staking functionality for fund theft, including a hardcoded destination wallet and silent execution via `prompt=False` and `transfer_all=True`. A multi-hop money laundering network is traced, and the typosquatting strategy (missing characters, truncation, version mimicking) is explained. The post emphasizes GitLab's automated package monitoring system and proactive security research in protecting the software supply chain.
  8. GitLab catches MongoDB Go module supply chain attackThis post details the discovery and takedown of a typosquatting attack targeting the MongoDB Go module. It describes the multi-layered malicious payload, the rapid redeployment of a second malicious version, and GitLab's proactive detection system which combines typosquatting detection, semantic code analysis, AI-assisted screening, and human review. It also provides Indicators of Compromise (IOCs) for the specific campaign.
  9. Automating cybersecurity threat detections with GitLab CI/CDThis post details the implementation of a Detections as Code (DaC) workflow using GitLab CI/CD to automate the creation, testing, and deployment of SIEM threat detections. Key components include storing detections in JSON format, using merge requests to trigger CI/CD pipelines for validation (query format, field validation, SIEM API checks), peer review, and automated deployment to the SIEM and MITRE ATT&CK lookup tables. The workflow emphasizes security through least privilege, version control, and automated testing.
  10. Reduce supply chain risk with smarter vulnerability prioritizationIntroduced Static Reachability Analysis to identify exploitable vulnerabilities from open source components, a Known Exploited Vulnerabilities (KEV) Indicator to highlight actively exploited vulnerabilities, and Exploit Prediction Scoring System (EPSS) to predict the likelihood of a vulnerability being exploited. These features are powered by acquisitions of Oxeye and Rezilion's IP.
  11. 5 things to know from our LinkedIn Live Security Deep DiveThis post details advancements in GitLab's security features, including the general availability of Advanced SAST with cross-file and cross-function scanning and taint analysis, the introduction of secret push protection to prevent accidental secret commits, the evolution of AI-assisted security features with Quick Chat for contextual insights, and the implementation of static reachability for Python and Java to reduce security noise by identifying used dependencies.
  12. Secure open source container infrastructure with GitLab and ChainguardThis post details the integration of Chainguard's minimal, hardened container images with low-to-no CVEs, container signing via Sigstore/Cosign, and GitLab's built-in vulnerability scanning tools (SAST, DAST, IaC, Container Scanning, Dependency Scanning, Secret Detection, API Fuzzing, Coverage-guided Fuzzing) to create a secure open-source container infrastructure. It provides examples of using Chainguard images in GitLab jobs and Dockerfiles, and explains how to leverage GitLab's CI/CD for container image signing and vulnerability scanning.
  13. 7 steps to enhance application security without slowing developer velocityThis post details a 7-step process for integrating application security scans into development workflows without sacrificing developer velocity. It covers assessing current states, enabling prioritized scans (secrets detection, dependency scanning), evaluating results, adjusting rulesets (SAST, secrets detection), prioritizing vulnerabilities, integrating scans into development pipelines (scan execution policies, merge request widget), and continuous improvement. It emphasizes collaboration between development, security, and operations teams and suggests integrating security training providers.
  14. Coming soon: GitLab dependency firewallThis post introduces the upcoming 'dependency firewall' feature, which will act as a first line of defense against software supply chain attacks. It outlines the planned capabilities: preventing malicious packages, checking against GitLab policy, quarantining packages, managing quarantined packages, and reporting package usage. The initial implementation will support a 'warn' policy for packages with known critical vulnerabilities downloaded through the dependency proxy. Future enhancements include support for lower severity vulnerabilities, UI warnings, quarantine rules, and review capabilities.
  15. Oxeye joins GitLab to advance application security capabilitiesGitLab has acquired Oxeye to accelerate its Static Application Security Testing (SAST) roadmap. Oxeye's enhanced SAST scanner will streamline vulnerability management and remediation for developers. Oxeye's capabilities also extend to tracing vulnerabilities from 'code to cloud' by providing runtime context, which will be used to enhance software composition analysis and compliance tools.
  16. GitLab's Maven dependency proxy is available in BetaIntroduces the Maven dependency proxy, a new feature for artifact management that allows enterprises to consolidate on the DevSecOps platform. The proxy caches packages from external Java repositories locally, improving pipeline speed and reliability, and reducing data transfer costs. It detects changes in external repositories and invalidates cached packages to ensure correct versions are downloaded and to help reduce security vulnerabilities. The feature is in the Premium tier and configurable via project settings. Roadmap includes npm, container, PyPI, and NuGet dependency proxies.
  17. SecureFlag integrated with GitLab for rapid vulnerability remediationThis post details the integration of SecureFlag's vulnerability remediation training into GitLab's DevSecOps platform. When GitLab security scanners detect vulnerabilities, SecureFlag provides a link to training resources with code examples and hands-on labs for developers to practice remediation. The integration streamlines the remediation process, enabling developers to fix issues more efficiently on their first attempt. It is available for GitLab Ultimate customers and can be enabled per project.
  18. Protestware threats: How to protect your software supply chainThis post details how to protect software supply chains from protestware threats by implementing dependency scanning, generating artifact attestations for provenance validation, utilizing private registries, and enabling the Dependency Proxy. It highlights GitLab's features like dependency scanning in CI, artifact attestation in GitLab Runner, package registry permissions, and the Dependency Proxy for caching and rate limit mitigation. It also mentions the upcoming Dependency Firewall for enhanced control over upstream packages.
  19. SourceWarp: Make data-driven, agile DevSecOps decisionsThis post introduces SourceWarp, a record-and-replay framework for source code management systems, designed to enable data-driven decision making for DevSecOps platforms. It details a case study where SourceWarp was used to benchmark advanced vulnerability tracking, demonstrating a 30% improvement in effectiveness compared to traditional methods. The tool is open-source and implemented in Ruby.
  20. Getting started with GitLab application securityThis post details how to enable and utilize GitLab's security scanning features, specifically focusing on dependency scanning as an example. It outlines the prerequisites for enabling scans, the process of adding scanner templates to `.gitlab-ci.yml` (both manually and via the UI), and how to view scan results. It also touches upon scan enforcement for Premium and Ultimate users and provides links to further resources. The post introduces the concept of enabling dependency scanning via the UI, which creates a merge request to update the `.gitlab-ci.yml` file, and shows how to view scan results in JSON reports and the merge request widget.
  21. How to secure memory-safe vs. manually managed languagesThis post details the risks associated with manually managed languages (C, C++) and advocates for memory-safe languages (Python, Java, Go). It highlights GitLab's SAST capabilities for C/C++ (Semgrep, Flawfinder) and memory-safe languages (Python, Go, Java, JavaScript, Ruby) with examples of detecting buffer overflows and SQL injection. It also mentions other security scanners like DAST, IaC scanning, dependency scanning, container scanning, license scanning, secret detection, and fuzzing.
  22. Top challenges to securing the software supply chainThis post discusses the challenges of securing the software supply chain, including the vast attack surface, the difficulty of implementing zero trust, and the increasing ease of launching cyber-attacks. It highlights the need for organizations to understand threat vectors and implement tools and processes like version control, multi-factor authentication, and automated security scanning. It also references a field guide for a deeper understanding of threat vectors and mitigation strategies.
  23. Meet the demand for SBOMs with GitLab and RezilionThis post details the integration of GitLab with Rezilion to enhance software supply chain security. It explains the need for SBOMs, the typical SDLC for vulnerability management, and how to implement GitLab's security scanners (SAST, DAST, IaC, Container, Dependency, Fuzzing, Secret Detection) via CI/CD templates or UI configuration. It also covers managing vulnerabilities through the MR view and vulnerability report, and generating SBOMs using GitLab's Dependency List (CycloneDX format) or Rezilion's dynamic SBOM. The integration with Rezilion specifically focuses on triaging exploitable vulnerabilities by identifying and filtering out false positives.
  24. Securing the software supply chain through automated attestationIntroduced automated compliance attestation in Release 15.1. GitLab Runner can generate and produce attestation metadata for all build artifacts by setting the RUNNER_GENERATE_ARTIFACTS_METADATA environment variable to "true". The metadata is rendered in a plain text .json file stored with the artifact. This feature aims to automate the previously manual and error-prone attestation process, providing build integrity guarantees and protecting against software tampering.
  25. Biden administration updates software supply chain security requirementsThis post details the Biden administration's increased focus on software supply chain security, driven by Executive Order 14028. It highlights the shift towards understanding code origins, the importance of SBOMs, and the government's expectation for proactive security measures. GitLab's role in enabling compliance through its platform features like SBOM creation, security dashboards, and various scanning tools is emphasized, aligning with the NIST SSDF 1.1 framework.
  26. How to get integrated secure coding advice in GitLabThis post details the integration of Secure Code Warrior with GitLab's vulnerability scanner. When scanners detect security issues in merge requests or pipeline scans, the integration provides a link to contextual secure coding guidance and interactive challenges within the Secure Code Warrior platform. This aims to empower developers with actionable advice to fix vulnerabilities faster and improve their secure coding practices.
  27. Reducing vulnerability backlog with Rezilion and GitLabThis post details the integration of Rezilion's DevSecOps technology with GitLab CI. Key contributions include: enabling developers to detect and remediate vulnerabilities early, reducing vulnerability backlog by up to 70% by identifying unexploitable vulnerabilities, prioritizing vulnerabilities based on exploitability, faster remediation by integrating Rezilion into the GitLab workflow, actionable insights within the CI pipeline (marking false positives), dynamic Software Bill of Materials (SBOM) for identifying loaded/unloaded components, and shifting security left by validating vulnerabilities in the CI pipeline. Results are available in the GitLab Security Dashboard and Vulnerability Management.
  28. How to enhance supply chain security with GitLab and TestifySecIntroduces the integration of TestifySec Witness into GitLab to enhance secure software supply chain capabilities. Witness documents the entire supply chain and development progress by creating a chain of custody from code creation through deployment, including SBOM and SLSA. It verifies and records CI system data, inputs, and outputs in a verifiable and standardized way, linking AWS identity metadata to build artifacts and other CI events.
  29. Community-driven advisory database for dependencies launchedIntroduced a community-driven advisory database for dependencies, a time-delayed clone of the internal GitLab Advisory Database. This open-source edition allows for community contributions and is integrated into tools like Trivy. The database uses CVE and CVSS for vulnerability communication and is integrated into GitLab Dependency Scanning and Vulnerability Pages.
  30. GitLab addresses Log4j vulnerabilities with security updatesThis post details the specific actions taken to address the Log4j vulnerabilities (CVE-2021-44228, CVE-2021-45046, CVE-2021-44832) by updating dependency scanning and SAST analyzers to use the latest Log4j versions (2.17.1) and removing Log4j as a dependency from the license scanning analyzer. It confirms that default configurations for SAST and Dependency Scanning are patched and provides recommended actions for customers running older versions or modified configurations, as well as for self-managed customers in offline environments. It also clarifies the low impact of CVE-2021-44832 and CVE-2021-45105 on the GitLab platform.
  31. Announcing 14.6 Composition Analysis deprecations and behavior changesThis post announces deprecations and behavior changes within GitLab's Composition Analysis features. Specifically, it details that the `DS_EXCLUDED_PATHS` variable now pre-filters paths, the `bundler-audit` tool is being deprecated from Dependency Scanning with a removal date in 15.0, and the License Compliance API is deprecating the legacy approval status names 'approved' and 'blacklisted' in favor of 'allowed' and 'denied'.
  32. SemVer versioning: how we handled it with linear interval arithmeticThis post details the development of the `semver_dialects` utility, an open-source Ruby gem, to process semantic versions in a generic, language-agnostic manner. This addresses the challenge of diverse SemVer dialects in package managers and registries, enabling greater automation in GitLab's advisory generation process for Dependency Scanning. The utility provides a unified interface, language-agnostic matching, range inversion, and parsing/production of different version syntaxes.
  33. How to write and continuously test vulnerability detection rules for SASTThis post details the development of a framework to transition GitLab SAST tools to Semgrep. It describes the architecture of a rule-testing framework that uses a central rule repository and GitLab CI/CD to perform automated gap analysis between original SAST analyzers and Semgrep rule-sets. The framework aims to ensure parity between new Semgrep rules and existing analyzers, addressing rule management, rule testing, and analyzer replacement challenges. The structure of the rule repository and mapping files are also explained.
  34. How DevSecOps can protect businesses from future supply chain attacksThis post introduces DevSecOps as a strategy to protect businesses from software supply chain attacks, highlighting the SolarWinds and Codecov incidents. It details how GitLab's platform, through security scanning (SAST, DAST, dependency scanning, etc.) and integration with Jscrambler, provides visibility and control over web supply chain risks. Jscrambler's capabilities include obfuscation, code locks, runtime protection, and real-time alerts for malicious behavior. The post emphasizes a defense-in-depth approach and a zero-trust model for website security.
  35. How to secure your container images with GitLab and GrypeThis post introduces Grype as a container image vulnerability scanner integrated into GitLab's Container Scanning feature. It details Grype's deep inspection capabilities for identifying vulnerabilities in container images and explains how to configure it via `.gitlab-ci.yml`. The post also announces the deprecation of Grype in favor of the Trivy scanner in future GitLab versions.
  36. A deep dive into how we investigate and secure GitLab packagesThis post details investigations into the behavior of GitLab's package registries, specifically confirming that the npm package registry checks the official npmjs.org registry only after verifying the package's presence on gitlab.com, aligning with best practices. It also highlights the proactive publishing of the internal npm package `@conventionalcomments/cc-parse` to npmjs.org to prevent potential future issues. The post also discusses the inherent security of Go modules against dependency confusion attacks and outlines plans for a future Dependency Firewall product category.
  37. How a DevOps Platform helps protect against supply chain attacksThis post outlines five steps to enhance application security and protect against supply chain attacks using a DevOps platform. It details the problems with traditional AppSec approaches and highlights the benefits of an integrated DevOps platform like GitLab, including end-to-end visibility, consistent policy administration, more intelligent response, and reduced attack surface. The five steps are: 1. Assess security hygiene (patches, passwords, secrets detection, MFA, visibility, access controls). 2. Automate scanning, policies, and compliance (SAST, DAST, dependency scanning, container scanning, secrets detection, fuzz testing, standardized CI pipelines, policy exceptions, segregation of duties, identity and access controls, configuration management, change control, access restrictions, protected branches/environments, auditing, licensed code usage, security testing). 3. Protect application infrastructure (container scanning, SAST for Helm charts, container host security, container network security, integration with Falco and AppArmor, container registry security). 4. Secure the software factory itself (Zero Trust, least privilege access, integration with Hashicorp Vault, hardening GitLab instances, secure CI/CD variables). 5. Implement a security program that combines people, processes, and tools with cross-department collaboration.
  38. Secure Composition Analysis 14.0 deprecations and removalsThis post announces the deprecation and removal of the License-Management CI template in version 14.0, renaming it to License-Scanning. It also details the upcoming change in Dependency Scanning from `DS_DEFAULT_ANALYZERS` to `DS_EXCLUDED_ANALYZERS`, requiring users to explicitly list analyzers to skip rather than those to run.
  39. Android App Security Testing with SASTThis post introduces the integration of Mobile Static Application Security Testing (SAST) for Android applications written in Java and Kotlin. It explains that SAST analyzes source code for vulnerabilities using the Mobile Security Framework (MobSF) and its regex-based rules. The post also details how to contribute custom rules to MobSF and integrate custom scanners into GitLab's merge request pipeline and security dashboards.
  40. Using the Dependency Proxy to improve your pipelinesThis post details the evolution of the Dependency Proxy, making it a core, free feature. It introduces support for private groups and subgroups, adds authentication for security and abuse prevention, and explains how it mitigates Docker Hub rate limiting by caching manifests and blobs. It also covers CI/CD integration improvements with new environment variables and automatic runner login.
  41. Tired of afterthought security? Take a fresh look at GitLab UltimateThis post details GitLab's comprehensive security scanning capabilities within its Ultimate/Gold tiers, emphasizing their integration into the developer workflow. It highlights SAST, dependency scanning, container scanning, API scanning, fuzz testing, secret detection, and license compliance. It also introduces the security dashboard for vulnerability management and container threat monitoring. The post mentions acquisitions of Peach Tech and Fuzzit, integrating fuzz testing capabilities.
  42. The Dependency Proxy is moving to open sourceThe Dependency Proxy is being made open source and free for all GitLab users, supporting proxying and caching of Docker Hub images and packages from npm, Maven, and PyPI. This addresses upcoming Docker Hub rate limits. Specific issues being addressed include support for private groups (requiring Docker login), caching of image manifests and blobs for offline availability, and bug fixes for cache retrieval on certain storage configurations and EC2 instances. Contributions are also being sought for npm package caching.
  43. How to secure your dependencies with GitLab and WhiteSourceThis post details the integration of WhiteSource for dependency scanning and auto-remediation. It covers the installation process, including creating GitLab service credentials, generating WhiteSource configurations, building and pushing Docker containers for WhiteSource components (wss-gls-app, wss-remediate, wss-scanner), and deploying them to a Kubernetes cluster using Helm. It also explains how to use the integration to scan repositories, generate vulnerability issues, and integrate with the GitLab Security Dashboard via CI/CD.
  44. Don’t let your dependency-laden software become the next monolithThis post discusses the broader challenges of managing software dependencies, including the risks associated with accumulating tech debt, the 'flammable' nature of dependencies, and the importance of dependency scanning and auto-remediation tools to mitigate these risks and build software with intention. It highlights the use of GitLab's built-in dependency scanning and auto-remediation features as solutions.
  45. Packaging now standard, dependency proxy next?This post announces the upcoming Dependency Proxy feature, which will enhance package management security and auditability by allowing users to block and delay suspect packages and trace vulnerable package usage. It also positions GitLab's existing integrated package management (Docker, Maven, NPM) and its broader DevOps lifecycle integration as a competitive advantage against GitHub's new package registry.