Group Direction - Composition Analysis

The following page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features or functionality remain at the sole discretion of GitLab Inc.

Composition Analysis
Overview
Priorities
- Features
- Maintenance

Composition Analysis


Stage	Secure
Content Last Reviewed	`2024-04-25`
Content Last Updated	`2024-04-25`

Overview

Composition Analysis is a group in the Secure stage. There are two categories in the group and details on the direction can be viewed on the following individual category pages:

Priorities

Features

Priority	Name	Target release
1	Continuous Vulnerability Scans for CS Post MVC Follow-up	`17.0`
2	Operational Container Scanning support for offline environments / Self-Signed certificates	`17.0`
3	GitLab Container Registry Continuous Scanning for latest tag	`17.2`
4	Dependency List support for Container Registry Scanning	`17.4`
5	Add Cargo support to License Scanning	`17.2`
6	Container Scanning: CVS Trigger Vulnerability scans on SBOM ingestion	`TBD`
7	Dependency Scanning: CVS Trigger vulnerability scans on SBOM changes	`TBD`
8	Android support for Dependency Scanning	`17.1`
9	Mark CVS vulnerabilities as No Longer Detected	`17.2`
10	Dependency Scanning support for Swift	`TBD`
11	Extend dependency graph support to other package managers	`TBD`
12	Follow-up from handover of the license database	`TBD`
13	Functional parity b/w Continuous Vulnerability Scans and Container Scanning jobs	`TBD`
14	Dependency Scanning Coverage Improvements	`TBD`
15	Efficient Dependency & Container Vulnerability Risk Prioritization via EPSS	`TBD`
16	Efficient Dependency & Container Vulnerability Risk Prioritization with KEV Data	`TBD`
17	Improve Auto remediation	`TBD`
18	Mature license scanning feature	`TBD`
19	Better support scanning of multiple images	`TBD`
20	User defined images	`TBD`

Maintenance

Priority	Name	Target release
1	Replace gemnasium-gradle-plugin with the htmlDependencyReport task in gemnasium-maven	`17.0`
2	GitLab 17.0 deprecations, removals and breaking changes	`17.0`
3	Use consolidated source for package metadata	`TBD`
4	Further License DB Reliability and Performance Improvements	`TBD`
5	Define toolchain support policy for container scanning and dependency scanning	`TBD`
6	Clean-up continuous vulnerability scanning experimental code	`TBD`
7	GitLab 18.0 deprecations, removals and breaking changes	`18.0`

*This page may contain information related to upcoming products, features and functionality.

It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes.

Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.*