GitLab 19.0 Launches SBOM-Based Dependency Scanning to Cut Supply Chain Risk
Software supply chains are under pressure like never before. GitLab is responding with something teams have needed for a long time. With GitLab 19.0, SBOM-based dependency scanning is now generally available, and it goes much deeper than traditional scanners ever could.
Third-party code makes up the majority of most modern codebases. As a result, four recent supply chain incidents demonstrated how a single compromised package can ripple across every project depending on it. Meanwhile, researchers warn that nearly half of AI-generated code carries vulnerabilities. The attack surface keeps growing, but older tools haven’t kept pace.
Traditional dependency scanners, including GitLab’s own Gemnasium analyzer, were built for one question: which declared packages have known CVEs? That approach worked years ago. Today, security teams face harder questions. How did a vulnerable package get in? What else came with it? Does the application actually use it? GitLab 19.0 answers all three.
The new SBOM-based dependency scanner catalogs every direct and transitive dependency in a project. It generates a machine-readable CycloneDX SBOM and matches components against the GitLab Advisory Database to flag known issues. Crucially, it traces the full dependency chain. If library-a pulls in library-b, which pulls in the vulnerable library-c, GitLab shows exactly where to intervene.
Beyond tracing, the scanner checks reachability. For Java, JavaScript/TypeScript, and Python projects, it identifies whether vulnerable packages are actually imported by application code or just pulled in transitively and never called. Not every dependency that appears in a manifest actually runs in production. Accordingly, GitLab surfaces reachability status on every finding, so teams focus remediation where real exposure exists.
Findings appear directly on merge requests, allowing developers to fix issues before shipping. Security teams also see consolidated results across every project through vulnerability dashboards and reports. Rollout is simpler too. GitLab 19.0 ships a security configuration profile for dependency scanning, letting teams configure scanning once and push it across hundreds of projects. Scan execution policies and pipeline execution policies enforce those standards at group or instance level, without editing a single .gitlab-ci.yml file.
The feature supports 24+ package ecosystems, with more on the way. Teams migrating from Gemnasium can run both analyzers side by side using the official migration guide to compare results before fully switching over.
SBOM-based dependency scanning is live now for GitLab Ultimate customers on GitLab.com, with rollout to Dedicated and self-managed instances on the standard release cadence. Teams can start immediately with the step-by-step setup tutorial or dive into the full technical documentation.
