Rationale
Third-party dependencies are a major attack vector. GitLab requires Composition Analysis to detect known vulnerabilities in dependencies before they are merged.
Enforcement
- SonarQube: Dependency-check plugin flags vulnerable libraries
- SpotBugs: Dependency vulnerability detection
Requirements
- Run dependency scanning on every CI pipeline
- Block merge if critical/high vulnerabilities are found
- Maintain a Software Bill of Materials (SBOM)
- Review new dependencies before adding (license compatibility, maintenance status)
- Update vulnerable dependencies within SLA:
- Critical: 7 days
- High: 30 days
- Medium: 90 days
Allowed Licenses
| License | Status |
|---|---|
| MIT, Apache-2.0, BSD-⅔ | Allowed |
| LGPL-2.1+ | Allowed with review |
| GPL-2.0+ | Prohibited |
| AGPL-3.0 | Prohibited |
References
- GitLab Composition Analysis: https://handbook.gitlab.com/handbook/security/product-security/composition-analysis/
- Software Supply Chain Security: https://handbook.gitlab.com/handbook/company/working-groups/software-supply-chain-security/