Reduce supply chain risk with SBOM-based dependency scanning

What this post added

Introduced SBOM-based dependency scanning as a generally available feature in GitLab 19.0. This new capability inventories all direct and transitive dependencies using the CycloneDX format and matches them against the GitLab Advisory Database to identify known vulnerabilities. It enhances traditional dependency scanning by allowing tracing of transitive dependencies, focusing on vulnerabilities that the code actually reaches (for Java, JavaScript/TypeScript, and Python), and enabling continuous scanning. The feature also introduces security configuration profiles and scan execution policies to enforce dependency scanning across multiple projects.