Using NPM Audit results in Dependency Scanning job and Group Level Security Dashboard
Hey All - I've been trying to get the Group Level Security Dashboard running with the Dependency Scanning job and I have been running into some issues. To back up a bit the reason why we decided to use the npm audit feature is because the results we were getting from the recommended dependency scanning job was not providing the full set of vulnerabilities that the npm audit command was returning. That's why we looked for an alternative solution and then found this module here: https://github.com/mgibeau/gitlab-npm-audit-parser
This module above (gitlab-npm-audit-parser) worked great for the repo level security dashboard, but now that we're looking to get a group level view into our security scanning results we've been having issues. One thing I noticed is that the Group Level Security dashboard needs the key "cve"in the results for the Group Level security dashboard to use the results. But now we're only seeing a subset of the vulnerabilities showing up in the Group Level security dashboard.
So I guess the question is how does Gitlab envision the future of security scanning for Node.js modules? And also is there information that can be provided for what the structure of the gl-dependency-scanning-report.json needs to be in order to be displayed in the Group Level security dashboard?