FIPS Package Dependency Management

5/26/2026

Introduced SBOM-based dependency scanning as a generally available feature in GitLab 19.0. This new capability inventories all direct and transitive dependencies using the CycloneDX format and matches them against the GitLab Advisory Database to identify known vulnerabilities. It enhances traditional dependency scanning by allowing tracing of transitive dependencies, focusing on vulnerabilities that the code actually reaches (for Java, JavaScript/TypeScript, and Python), and enabling continuous scanning. The feature also introduces security configuration profiles and scan execution policies to enforce dependency scanning across multiple projects.

4/24/2026

This post announces a change in Omnibus-GitLab FIPS packages: the bundled, GitLab-built curl will be removed starting in version 19.0. Instead, FIPS packages will rely on the curl package provided by the customer's Linux distribution. This aligns with the existing model for OpenSSL in FIPS packages and is driven by curl's deprecation of OpenSSL 1.x support. Customers will be responsible for keeping their OS's curl up to date for security patches. This change has no immediate impact on instance functionality but shifts security update responsibility for curl to the customer.

3/26/2024

Introduces the upcoming 'dependency firewall' feature, which will act as a security layer for package downloads. It will include policy-based warnings or blocks for packages with known vulnerabilities, building upon the existing Maven dependency proxy. The initial implementation will focus on warning about critical vulnerabilities detected by dependency scanning.

12/11/2023

Introduces the Maven dependency proxy, a new feature for artifact management that allows enterprises to consolidate on the DevSecOps platform. The proxy caches packages from external Java repositories locally, improving pipeline speed and reliability, and reducing data transfer costs. It detects changes in external repositories and invalidates cached packages to ensure correct versions are downloaded and to help reduce security vulnerabilities. The feature is in the Premium tier and configurable via project settings. Roadmap includes npm, container, PyPI, and NuGet dependency proxies.

5/9/2023

This post introduces artifact attestation for generating provenance in the in-toto format, enabling verification of build processes and achieving SLSA Level 2 compliance. It also highlights the use of private registries for enhanced control over dependencies and the integration of dependency scanning within CI pipelines to detect vulnerabilities. The post also details the use of the Dependency Proxy to reduce requests to upstream registries and mitigate the impact of upstream changes or vulnerabilities.

3/15/2023

This post details how to enable and utilize GitLab's security scanning features, specifically focusing on dependency scanning as an example. It outlines the prerequisites for enabling scans, the process of adding scanner templates to `.gitlab-ci.yml` (both manually and via the UI), and how to view scan results. It also touches upon scan enforcement for Premium and Ultimate users and provides links to further resources. The post introduces the concept of enabling dependency scanning via the UI, which creates a merge request to update the `.gitlab-ci.yml` file, and shows how to view scan results in JSON reports and the merge request widget.

11/7/2022

This post discusses the challenges of securing the software supply chain, including the vast attack surface, the difficulty of implementing zero trust, and the increasing ease of launching cyber-attacks. It highlights the need for organizations to understand threat vectors and implement tools and processes like version control, multi-factor authentication, and automated security scanning. It also references a field guide for a deeper understanding of threat vectors and mitigation strategies.

10/17/2022

This post details the integration of GitLab with Rezilion to enhance software supply chain security. It explains the need for SBOMs, the typical SDLC for vulnerability management, and how to implement GitLab's security scanners (SAST, DAST, IaC, Container, Dependency, Fuzzing, Secret Detection) via CI/CD templates or UI configuration. It also covers managing vulnerabilities through the MR view and vulnerability report, and generating SBOMs using GitLab's Dependency List (CycloneDX format) or Rezilion's dynamic SBOM. The integration with Rezilion specifically focuses on triaging exploitable vulnerabilities by identifying and filtering out false positives.

8/10/2022

Introduced automated compliance attestation in Release 15.1. GitLab Runner can generate and produce attestation metadata for all build artifacts by setting the RUNNER_GENERATE_ARTIFACTS_METADATA environment variable to "true". The metadata is rendered in a plain text .json file stored with the artifact. This feature aims to automate the previously manual and error-prone attestation process, providing build integrity guarantees and protecting against software tampering.

5/12/2022

This post details the Biden administration's increased focus on software supply chain security, driven by Executive Order 14028. It highlights the shift towards understanding code origins, the importance of SBOMs, and the government's expectation for proactive security measures. GitLab's role in enabling compliance through its platform features like SBOM creation, security dashboards, and various scanning tools is emphasized, aligning with the NIST SSDF 1.1 framework.

3/23/2022

This post details the integration of Rezilion's DevSecOps technology with GitLab CI. Key benefits include reducing vulnerability backlog by identifying unexploitable vulnerabilities, prioritizing remediation efforts, faster remediation through direct integration, actionable insights within the CI pipeline, dynamic SBOM generation, and shifting security left. The integration provides results within the GitLab Security Dashboard and Vulnerability Management.

3/16/2022

Introduces the integration of TestifySec Witness into GitLab to enhance secure software supply chain capabilities. Witness documents the entire supply chain and development progress by creating a chain of custody from code creation through deployment, including SBOM and SLSA. It verifies and records CI system data, inputs, and outputs in a verifiable and standardized way, linking AWS identity metadata to build artifacts and other CI events.

2/16/2022

Launched a community-driven advisory database for dependencies, a time-delayed clone of the internal GitLab Advisory Database. This database is open-source and allows community contributions. It details how to contribute advisories, use CWE and CVSS, and integrate with tools like Trivy. The `community-sync` flag was introduced for faster synchronization of community contributions. Certain critical vulnerabilities, like log4Shell, are prioritized for immediate release to the open-source version.

1/6/2022

This post discusses the broader context of securing the software supply chain, emphasizing the integration of security into DevOps processes (DevSecOps) and the importance of various security scans like container scanning, dependency scanning, fuzz testing, DAST, SAST, license compliance, and secret detection. It highlights the benefits of integrating security, such as increased likelihood of meeting organizational goals and improved reliability.

12/15/2021

Updated SAST and Dependency Scanning analyzers to use Log4j 2.17.1. Removed Log4j as a dependency from the license scanning analyzer. Investigated and determined low impact for CVE-2021-44832. Updated Log4j to version 2.16 in Spotbugs and Gemnasium-Maven analyzers for CVE-2021-45105 and CVE-2021-44228. Provided guidance for customers on updating analyzers and offline environments.

12/13/2021

This post announces changes to the Composition Analysis feature. The DS_EXCLUDED_PATHS variable now pre-filters excluded paths, improving performance and reducing warnings. The bundler-audit tool for Dependency Scanning is deprecated and will be removed in version 15.0. The License Compliance API has deprecated legacy approval status names ('approved', 'blacklisted') in favor of 'allowed' and 'denied'.

9/28/2021

This post introduces and open-sources `semver_dialects`, a utility designed to process semantic versions in a language-agnostic manner. It addresses the challenge of SemVer versioning fragmentation across different ecosystems (gem, maven, npm, php, pypi, go, nuget, conan) by providing a unified interface, enabling language-agnostic matching, range inversion, handling of scattered ranges, parsing of different version syntaxes, and best-effort matching. The utility normalizes semantic versions into a comparable format by extending prefix and suffix lengths and numerically comparing segments, with lexical matching as a fallback. This is crucial for automating the advisory generation process for GitLab's Dependency Scanning feature by accurately identifying vulnerable and fixed versions of software dependencies.

8/18/2021

This post introduces DevSecOps as a strategy to protect businesses from software supply chain attacks, highlighting the SolarWinds and Codecov incidents. It details how GitLab's platform, through security scanning (SAST, DAST, dependency scanning, etc.) and integration with Jscrambler, provides visibility and control over web supply chain risks. Jscrambler's capabilities include obfuscation, code locks, runtime protection, and real-time alerts for malicious behavior. The post emphasizes a defense-in-depth approach and a zero-trust model for website security.

7/28/2021

This post introduces Grype as a container image vulnerability scanner integrated into GitLab's Container Scanning feature. It details Grype's deep inspection capabilities for identifying vulnerabilities in container images and explains how to configure it via `.gitlab-ci.yml`. The post also announces the deprecation of Grype in favor of the Trivy scanner in future GitLab versions.

5/27/2021

This post details investigations into the behavior of GitLab's package registries, specifically confirming that the npm package registry checks the official npmjs.org registry only after verifying the package's presence on gitlab.com, aligning with best practices. It also highlights the proactive publishing of the internal npm package `@conventionalcomments/cc-parse` to npmjs.org to prevent potential future issues. The post also discusses the inherent security of Go modules against dependency confusion attacks and outlines plans for a future Dependency Firewall product category.

4/28/2021

This post outlines five steps to enhance application security and protect against supply chain attacks using a DevOps platform. It details the problems with traditional AppSec approaches and highlights the benefits of an integrated DevOps platform like GitLab, including end-to-end visibility, consistent policy administration, more intelligent response, and reduced attack surface. The five steps are: 1. Assess security hygiene (patches, passwords, secrets detection, MFA, visibility, access controls). 2. Automate scanning, policies, and compliance (SAST, DAST, dependency scanning, container scanning, secrets detection, fuzz testing, standardized CI pipelines, policy exceptions, segregation of duties, identity and access controls, configuration management, change control, access restrictions, protected branches/environments, auditing, licensed code usage, security testing). 3. Protect application infrastructure (container scanning, SAST for Helm charts, container host security, container network security, integration with Falco and AppArmor, container registry security). 4. Secure the software factory itself (Zero Trust, least privilege access, integration with Hashicorp Vault, hardening GitLab instances, secure CI/CD variables). 5. Implement a security program that combines people, processes, and tools with cross-department collaboration.

2/8/2021

This post announces the deprecation and removal of the License-Management CI template in version 14.0, renaming it to License-Scanning. It also details the upcoming change in Dependency Scanning from `DS_DEFAULT_ANALYZERS` to `DS_EXCLUDED_ANALYZERS`, requiring users to explicitly list analyzers to skip rather than those to run.

12/15/2020

This post details the evolution of the Dependency Proxy, making it a core, free feature. It introduces support for private groups and subgroups, adds authentication for security and abuse prevention, and explains how it mitigates Docker Hub rate limiting by caching manifests and blobs. It also covers CI/CD integration improvements with new environment variables and automatic runner login.

12/8/2020

This post details GitLab's comprehensive security scanning capabilities within its Ultimate/Gold tiers, emphasizing their integration into the developer workflow. It highlights SAST, dependency scanning, container scanning, API scanning, fuzz testing, secret detection, and license compliance. It also introduces the security dashboard for vulnerability management and container threat monitoring. The post mentions acquisitions of Peach Tech and Fuzzit, integrating fuzz testing capabilities.

10/30/2020

The Dependency Proxy is being made open source and free for all GitLab users, supporting proxying and caching of Docker Hub images and packages from npm, Maven, and PyPI. This addresses upcoming Docker Hub rate limits. Specific issues being addressed include support for private groups (requiring Docker login), caching of image manifests and blobs for offline availability, and bug fixes for cache retrieval on certain storage configurations and EC2 instances. Contributions are also being sought for npm package caching.

8/10/2020

This post details the integration of WhiteSource for dependency scanning and auto-remediation. It covers the installation process, including creating GitLab service credentials, generating WhiteSource configurations, building and pushing Docker containers for WhiteSource components (wss-gls-app, wss-remediate, wss-scanner), and deploying them to a Kubernetes cluster using Helm. It also explains how to use the integration to scan repositories, generate vulnerability issues, and integrate with the GitLab Security Dashboard via CI/CD.

9/9/2019

This post discusses the broader challenges of managing software dependencies, including the risks associated with accumulating tech debt, the 'flammable' nature of dependencies, and the importance of dependency scanning and auto-remediation tools to mitigate these risks and build software with intention. It highlights the use of GitLab's built-in dependency scanning and auto-remediation features as solutions.

5/10/2019

This post announces the upcoming Dependency Proxy feature, which will enhance package management security and auditability by allowing users to block and delay suspect packages and trace vulnerable package usage. It also positions GitLab's existing integrated package management (Docker, Maven, NPM) and its broader DevOps lifecycle integration as a competitive advantage against GitHub's new package registry.