Using Dependency Scanning to find vulnerabilities in dependencies
Why write your own functions when someone else has already written, tested, and documented a library to perform exactly what you need? It’s often easy to find third-party Python modules, Ruby gems, Java JARs, or other open-source software packages that speed up the development of your project. Unfortunately, these third-party dependencies can contain security vulnerabilities, and if you include them in your project, you inherit those problems. This is where GitLab’s Dependency Scanning feature steps in – it ensures that any dependencies you use are free of known vulnerabilities.
Understanding Dependency Scanning
Like SAST, Dependency Scanning supports many languages – including all of the major languages you’d expect – but not every language under the Sun. You can consult the GitLab documentation to see an up-to-date list of supported languages.
