Group Direction - Composition Analysis

The following page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features or functionality remain at the sole discretion of GitLab Inc.

Composition Analysis
Overview
Priorities
- Features
- Maintenance

Composition Analysis


Stage	Secure
Content Last Reviewed	`2024-12-20`
Content Last Updated	`2024-12-20`

Overview

Composition Analysis is a group in the Secure stage. There are two categories in the group and details on the direction can be viewed on the following individual category pages:

Priorities

Features

Priority	Name	Target release
1	Extend dependency graph support to other package managers	`17.8`
2	Deprecate build support on Dependency Scanning	`17.8`
3	SBOM-based Dependency Scanning for non-default branches	`TBD`
4	License Scanning support for Swift	`17.8`
5	Support SPDX license expressions	`TBD`
6	Mature Static Reachability	`TBD`
7	Better support scanning of multiple images	`TBD`
8	Support for license scanning of OS packages provided by SBOM	`TBD`
9	Auto-remediation MVC	`TBD`
10	Add shortest path information when creating vulnerability from CVS	`TBD`
11	Allow user to disable using the CyCloneDX report as source for license information	`17.10`
12	Allow users to provide license information for components	`TBD`
13	Improve Auto remediation	`TBD`
14	Support SPDX SBOM generation	`TBD`
15	Provide .tar file support to scan multiple images	`TBD`
16	Support for license risk	`TBD`
17	Python license information from deps.dev	`TBD`
18	Operational Container Scanning support for offline environments / Self-Signed certificates	`TBD`
19	Functional parity b/w Continuous Vulnerability Scans and Container Scanning jobs	`TBD`
20	User defined images	`TBD`
21	Deprecate and remove Gemnasium	`17.9`

Maintenance

Priority	Name	Target release
1	Further License DB Reliability and Performance Improvements	`TBD`
2	Add E2E testing for Operational Container Scanning	`TBD`
3	Decouple scanner class from pipeline security reports	`TBD`
4	Define toolchain support policy for container scanning and dependency scanning	`TBD`
5	Use osv.dev in favor of GLAD for DS	`TBD`
6	Clean-up continuous vulnerability scanning experimental code	`TBD`
7	GitLab 18.0 deprecations, removals and breaking changes	`18.0`

*This page may contain information related to upcoming products, features and functionality.

It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes.

Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.*