Group Direction - Composition Analysis

The following page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features or functionality remain at the sole discretion of GitLab Inc.

Composition Analysis
Overview
Priorities
- Features
- Maintenance

Composition Analysis


Stage	Secure
Content Last Reviewed	`2024-11-19`
Content Last Updated	`2024-11-19`

Overview

Composition Analysis is a group in the Secure stage. There are two categories in the group and details on the direction can be viewed on the following individual category pages:

Priorities

Features

Priority	Name	Target release
1	Efficient Dependency & Container Vulnerability Risk Prioritization via EPSS	`17.6`
2	CVS Trigger vulnerability scans on SBOM changes	`17.4`
3	Efficient Dependency & Container Vulnerability Risk Prioritization with KEV Data	`17.7`
4	Extend dependency graph support to other package managers	`17.6`
5	Static Reachability MVC	`TBD`
6	SBOM-based security findings in CI	`17.5`
7	Provide a way to collect license compliance artifact with DS	`17.6`
8	Dependency List support for Container Registry Scanning	`17.6`
9	Deprecate build support on Dependency Scanning	`17.7`
10	Support for license risk	`17.7`
11	Support SPDX license expressions	`TBD`
12	Better support scanning of multiple images	`TBD`
13	Improve Auto remediation	`17.10`
14	Functional parity b/w Continuous Vulnerability Scans and Container Scanning jobs	`TBD`
15	Allow users to provide license information for components	`TBD`
16	Support license scanning for Container Scanning	`TBD`
17	Support SPDX SBOM generation	`TBD`
18	User defined images	`TBD`
19	Operational Container Scanning support for offline environments / Self-Signed certificates	`TBD`
20	Container Scanning support for tar images	`TBD`
21	Deprecate and remove Gemnasium	`17.9`

Maintenance

Priority	Name	Target release
1	Further License DB Reliability and Performance Improvements	`17.5`
2	Add E2E testing for Operational Container Scanning	`17.4`
3	Decouple scanner class from pipeline security reports	`TBD`
4	Define toolchain support policy for container scanning and dependency scanning	`TBD`
5	Use osv.dev in favor of GLAD for DS	`TBD`
6	Clean-up continuous vulnerability scanning experimental code	`TBD`
7	GitLab 18.0 deprecations, removals and breaking changes	`18.0`

*This page may contain information related to upcoming products, features and functionality.

It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes.

Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.*