config/gitlab_loose_foreign_keys.yml

@@ -407,6 +407,10 @@ user_details:
   - table: namespaces
     column: enterprise_group_id
     on_delete: async_nullify
+vulnerability_export_parts:
+  - table: organizations
+    column: organization_id
+    on_delete: async_delete
 vulnerability_feedback:
   - table: ci_pipelines
     column: pipeline_id

db/docs/vulnerability_export_parts.yml

@@ -7,7 +7,7 @@ feature_categories:
 description: Track partial files to enable large data exports
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/152517
 milestone: '17.1'
-gitlab_schema: gitlab_main_cell
+gitlab_schema: gitlab_sec
 sharding_key:
   organization_id: organizations
 

db/post_migrate/20240712130758_remove_organizations_vulnerability_export_parts_organization_id_fk.rb

+# frozen_string_literal: true
+
+class RemoveOrganizationsVulnerabilityExportPartsOrganizationIdFk < Gitlab::Database::Migration[2.2]
+  milestone '17.3'
+  disable_ddl_transaction!
+
+  FOREIGN_KEY_NAME = "fk_rails_feaf890d7a"
+
+  def up
+    with_lock_retries do
+      remove_foreign_key_if_exists(:vulnerability_export_parts, :organizations,
+        name: FOREIGN_KEY_NAME, reverse_lock_order: true)
+    end
+  end
+
+  def down
+    add_concurrent_foreign_key(:vulnerability_export_parts, :organizations,
+      name: FOREIGN_KEY_NAME, column: :organization_id,
+      target_column: :id, on_delete: :cascade)
+  end
+end

db/schema_migrations/20240712130758

+5a49baf69727aeb9a53f2608d6798b7c371bc71982cd6900fe574851a8f10467
\ No newline at end of file

db/structure.sql

@@ -35348,9 +35348,6 @@ ALTER TABLE ONLY cluster_groups
 ALTER TABLE ONLY resource_label_events
     ADD CONSTRAINT fk_rails_fe91ece594 FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE SET NULL;
-ALTER TABLE ONLY vulnerability_export_parts
-    ADD CONSTRAINT fk_rails_feaf890d7a FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY pages_deployment_states
     ADD CONSTRAINT fk_rails_ff6ca551a4 FOREIGN KEY (pages_deployment_id) REFERENCES pages_deployments(id) ON DELETE CASCADE;

doc/user/application_security/configuration/index.md

@@ -59,7 +59,7 @@ You can configure the following security controls:
 - [Container Scanning](../container_scanning/index.md)
   - Select **Configure with a merge request** to create a merge request with the changes required to
     enable Container Scanning. For more details, see
-    [Enable Container Scanning through an automatic merge request](../container_scanning/index.md#enable-container-scanning-through-an-automatic-merge-request).
+    [Enable Container Scanning through an automatic merge request](../container_scanning/index.md#use-a-preconfigured-merge-request).
 - [Container Scanning For Registry](../container_scanning/index.md#container-scanning-for-registry)
   - Enable toggle to configure **Container Scanning For Registry** for the current project.
 - [Operational Container Scanning](../../clusters/agent/vulnerabilities.md)

doc/user/application_security/container_scanning/index.md

@@ -31,8 +31,8 @@ dependencies that are almost always imported from external sources, rather than
 you wrote yourself.
 
 GitLab offers both Container Scanning and [Dependency Scanning](../dependency_scanning/index.md)
-to ensure coverage for all of these dependency types. To cover as much of your risk area as
-possible, we encourage you to use all of our security scanners. For a comparison of these features, see
+to ensure coverage for all these dependency types. To cover as much of your risk area as
+possible, we encourage you to use all the security scanners. For a comparison of these features, see
 [Dependency Scanning compared to Container Scanning](../comparison_dependency_and_container_scanning.md).
 
 GitLab integrates with the [Trivy](https://github.com/aquasecurity/trivy) security scanner to perform vulnerability static analysis in containers.
@@ -44,23 +44,20 @@ The existing current major version for the Grype analyzer image will continue to
 latest advisory database, and operating system packages until GitLab 19.0, at which point the analyzer
 will stop working.
 
-To integrate GitLab with security scanners other than those listed here, see
-[Security scanner integration](../../../development/integrations/secure.md).
+GitLab compares the found vulnerabilities between the source and target branches, then:
 
-You can enable container scanning by doing one of the following:
-
-- [Include the CI job](#configuration) in your existing `.gitlab-ci.yml` file.
-- Implicitly use [Auto Container Scanning](../../../topics/autodevops/stages.md#auto-container-scanning),
-  provided by [Auto DevOps](../../../topics/autodevops/index.md).
-
-GitLab compares the found vulnerabilities between the source and target branches, and shows the
-information directly in the merge request.
+- Displays the results in the merge request widget.
+- Saves the results as a [container scanning report artifact](../../../ci/yaml/artifacts_reports.md#artifactsreportscontainer_scanning)
+  that you can download and analyze later. When downloading, you always receive the most recent
+  artifact.
+- Saves a [CycloneDX SBOM JSON report](#cyclonedx-software-bill-of-materials) which lists the
+  components detected.
 
 ![Container Scanning Widget](img/container_scanning_v13_2.png)
 
-## Capabilities
+## Features
 
-| Capability | In Free and Premium | In Ultimate |
+| Features | In Free and Premium | In Ultimate |
 | --- | ------ | ------ |
 | Customize Settings ([Variables](#available-cicd-variables), [Overriding](#overriding-the-container-scanning-template), [offline environment support](#running-container-scanning-in-an-offline-environment), etc) | **{check-circle}** Yes | **{check-circle}** Yes |
 | [View JSON Report](#reports-json-format) as a CI job artifact | **{check-circle}** Yes | **{check-circle}** Yes |
@@ -76,15 +73,19 @@ information directly in the merge request.
 | [Access to Security Dashboard page](#security-dashboard) | **{dotted-circle}** No | **{check-circle}** Yes |
 | [Access to Dependency List page](../dependency_list/index.md) | **{dotted-circle}** No | **{check-circle}** Yes |
 
-## Prerequisites
+## Configuration
+
+Enable the Container Scanning analyzer in your CI/CD pipeline. When a pipeline runs, the images your
+application depends on are scanned for vulnerabilities. You can customize Container Scanning by
+using CI/CD variables.
+
+### Enabling the analyzer
 
-To enable container scanning in your pipeline, you need the following:
+Prerequisites:
 
-- GitLab CI/CD pipeline must include the `test` stage, which is available unless overridden with the [`stages`](../../../ci/yaml/index.md#stages) keyword.
-- [GitLab Runner](https://docs.gitlab.com/runner/) with the [`docker`](https://docs.gitlab.com/runner/executors/docker.html)
-  or [`kubernetes`](https://docs.gitlab.com/runner/install/kubernetes.html) executor on Linux/amd64.
-- Docker `18.09.03` or later installed on the same computer as the runner. If you're using the
-  instance runners on GitLab.com, then this is already the case.
+- The test stage is required in the `.gitlab-ci.yml` file.
+- With self-managed runners you need a GitLab Runner with the `docker` or `kubernetes` executor on
+  Linux/amd64. If you're using the instance runners on GitLab.com, this is enabled by default.
 - An image matching the [supported distributions](#supported-distributions).
 - [Build and push](../../packages/container_registry/build_and_push_images.md#use-gitlab-cicd)
   the Docker image to your project's container registry.
@@ -92,56 +93,76 @@ To enable container scanning in your pipeline, you need the following:
   credentials through the `CS_REGISTRY_USER` and `CS_REGISTRY_PASSWORD` [configuration variables](#available-cicd-variables).
   For more details on how to use these variables, see [authenticate to a remote registry](#authenticate-to-a-remote-registry).
 
-## Configuration
+To enable the analyzer, either:
 
-To enable container scanning, add the
-[`Container-Scanning.gitlab-ci.yml` template](https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/Jobs/Container-Scanning.gitlab-ci.yml)
-to your `.gitlab-ci.yml` file:
+- Enable Auto DevOps, which includes dependency scanning.
+- Use a preconfigured merge request.
+- Create a [scan execution policy](../policies/scan-execution-policies.md) that enforces container
+  scanning.
+- Edit the `.gitlab-ci.yml` file manually.
 
-```yaml
-include:
-  - template: Jobs/Container-Scanning.gitlab-ci.yml
-```
+#### Use a preconfigured merge request
 
-The included template:
+This method automatically prepares a merge request that includes the container scanning template
+in the `.gitlab-ci.yml` file. You then merge the merge request to enable dependency scanning.
 
-- Creates a `container_scanning` job in your CI/CD pipeline.
-- Pulls the built Docker image from your project's [container registry](../../packages/container_registry/index.md)
-  (see [prerequisites](#prerequisites)) and scans it for possible vulnerabilities.
+NOTE:
+This method works best with no existing `.gitlab-ci.yml` file, or with a minimal configuration file.
+If you have a complex GitLab configuration file it might not be parsed successfully, and an error
+might occur. In that case, use the [manual](#edit-the-gitlab-ciyml-file-manually) method instead.
 
-GitLab saves the results as a
-[Container Scanning report artifact](../../../ci/yaml/artifacts_reports.md#artifactsreportscontainer_scanning)
-that you can download and analyze later. When downloading, you always receive the most-recent
-artifact. A [CycloneDX SBOM JSON report](#cyclonedx-software-bill-of-materials) is also created to report the list of components.
+To enable Container Scanning:
 
-The following is a sample `.gitlab-ci.yml` that builds your Docker image, pushes it to the container
-registry, and scans the image:
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Secure > Security configuration**.
+1. In the **Container Scanning** row, select **Configure with a merge request**.
+1. Select **Create merge request**.
+1. Review the merge request, then select **Merge**.
 
-```yaml
-include:
-  - template: Jobs/Build.gitlab-ci.yml
-  - template: Jobs/Container-Scanning.gitlab-ci.yml
+Pipelines now include a Container Scanning job.
 
-container_scanning:
-  variables:
-    CS_DEFAULT_BRANCH_IMAGE: $CI_REGISTRY_IMAGE/$CI_DEFAULT_BRANCH:$CI_COMMIT_SHA
-```
+#### Edit the `.gitlab-ci.yml` file manually
 
-Setting `CS_DEFAULT_BRANCH_IMAGE` avoids duplicate vulnerability findings when an image name differs across branches.
-The value of `CS_DEFAULT_BRANCH_IMAGE` indicates the name of the scanned image as it appears on the default branch.
-For more details on how this deduplication is achieved, see [Setting the default branch image](#setting-the-default-branch-image).
+This method requires you to manually edit the existing `.gitlab-ci.yml` file. Use this method if
+your GitLab CI/CD configuration file is complex or you need to use non-default options.
 
-### Customizing the container scanning settings
+To enable Container Scanning:
 
-There may be cases where you want to customize how GitLab scans your containers. For example, you
-may want to enable more verbose output, access a Docker registry that requires
-authentication, and more. To change such settings, use the [`variables`](../../../ci/yaml/index.md#variables)
-parameter in your `.gitlab-ci.yml` to set [CI/CD variables](#available-cicd-variables).
-The variables you set in your `.gitlab-ci.yml` overwrite those in
-`Container-Scanning.gitlab-ci.yml`.
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Build > Pipeline editor**.
+1. If no `.gitlab-ci.yml` file exists, select **Configure pipeline**, then delete the example
+   content.
+1. Copy and paste the following to the bottom of the `.gitlab-ci.yml` file. If an `include` line
+   already exists, add only the `template` line below it.
+
+   ```yaml
+   include:
+     - template: Jobs/Container-Scanning.gitlab-ci.yml
+   ```
+
+1. Select the **Validate** tab, then select **Validate pipeline**.
+
+   The message **Simulation completed successfully** confirms the file is valid.
+1. Select the **Edit** tab.
+1. Complete the fields. Do not use the default branch for the **Branch** field.
+1. Select the **Start a new merge request with these changes** checkbox, then select
+   **Commit changes**.
+1. Complete the fields according to your standard workflow, then select **Create merge request**.
+1. Review and edit the merge request according to your standard workflow, wait until the pipeline
+   passes, then select **Merge**.
+
+Pipelines now include a Container Scanning job.
+
+### Customizing analyzer behavior
 
-This example [includes](../../../ci/yaml/index.md#include) the container scanning template and
-enables verbose output for the analyzer:
+To customize Container Scanning, use [CI/CD variables](#available-cicd-variables).
+
+#### Enable verbose output
+
+Enable verbose output when you need to see in detail what the Dependency Scanning job does, for
+example when troubleshooting.
+
+In the following example, the Container Scanning template is included and verbose output is enabled.
 
 ```yaml
 include:
@@ -222,12 +243,13 @@ See [Use security scanning tools with merge request pipelines](../index.md#use-s
 
 #### Available CI/CD variables
 
-You can [configure](#customizing-the-container-scanning-settings) analyzers by using the following CI/CD variables.
+To customize Container Scanning, use CI/CD variables. The following table lists CI/CD variables
+specific to Container Scanning. You can also use any of the [predefined CI/CD variables](../../../ci/variables/predefined_variables.md).
 
 WARNING:
-All customization of GitLab security scanning tools should be tested in a merge request before
-merging these changes to the default branch. Failure to do so can give unexpected results,
-including a large number of false positives.
+Test customization of GitLab analyzers in a merge request before merging these changes to the
+default branch. Failure to do so can give unexpected results, including a large number of false
+positives.
 
 | CI/CD Variable                 | Default       | Description |
 | ------------------------------ | ------------- | ----------- |
@@ -239,28 +261,27 @@ including a large number of false positives.
 | `CS_DISABLE_DEPENDENCY_LIST`   | `"false"`      | **{warning}** **[Removed](https://gitlab.com/gitlab-org/gitlab/-/issues/439782)** in GitLab 17.0. |
 | `CS_DISABLE_LANGUAGE_VULNERABILITY_SCAN` | `"true"` | Disable scanning for language-specific packages installed in the scanned image. |
 | `CS_DOCKER_INSECURE`           | `"false"`     | Allow access to secure Docker registries using HTTPS without validating the certificates. |
-| `CS_DOCKERFILE_PATH`              | `Dockerfile`  | The path to the `Dockerfile` to use for generating remediations. By default, the scanner looks for a file named `Dockerfile` in the root directory of the project. You should configure this variable only if your `Dockerfile` is in a non-standard location, such as a subdirectory. See [Solutions for vulnerabilities](#solutions-for-vulnerabilities-auto-remediation) for more details. |
-| `CS_IGNORE_STATUSES`<sup><b><a href="#notes-regarding-cs-ignore-statuses">1</a></b></sup> | `""` | Force the analyzer to ignore vulnerability findings with specified statuses in a comma-delimited list. For `trivy`, the following values are allowed: `unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life`. |
+| `CS_DOCKERFILE_PATH`           | `Dockerfile`  | The path to the `Dockerfile` to use for generating remediations. By default, the scanner looks for a file named `Dockerfile` in the root directory of the project. You should configure this variable only if your `Dockerfile` is in a non-standard location, such as a subdirectory. See [Solutions for vulnerabilities](#solutions-for-vulnerabilities-auto-remediation) for more details. |
+| `CS_IGNORE_STATUSES`           | `""` | Force the analyzer to ignore vulnerability findings with specified statuses in a comma-delimited list. For `trivy`, the following values are allowed: `unknown,not_affected,affected,fixed,under_investigation,will_not_fix,fix_deferred,end_of_life`. <sup>1</sup> |
 | `CS_IGNORE_UNFIXED`            | `"false"`     | Ignore vulnerabilities that are not fixed. |
 | `CS_IMAGE`                 | `$CI_APPLICATION_REPOSITORY:$CI_APPLICATION_TAG` | The Docker image to be scanned. If set, this variable overrides the `$CI_APPLICATION_REPOSITORY` and `$CI_APPLICATION_TAG` variables. |
 | `CS_IMAGE_SUFFIX`              | `""`          | Suffix added to `CS_ANALYZER_IMAGE`. If set to `-fips`, `FIPS-enabled` image is used for scan. See [FIPS-enabled images](#fips-enabled-images) for more details. |
 | `CS_QUIET`                     | `""`          | If set, this variable disables output of the [vulnerabilities table](#container-scanning-job-log-format) in the job log. [Introduced](https://gitlab.com/gitlab-org/security-products/analyzers/container-scanning/-/merge_requests/50) in GitLab 15.1. |
 | `CS_REGISTRY_INSECURE`         | `"false"`     | Allow access to insecure registries (HTTP only). Should only be set to `true` when testing the image locally. Works with all scanners, but the registry must listen on port `80/tcp` for Trivy to work. |
-| `CS_REGISTRY_PASSWORD`              | `$CI_REGISTRY_PASSWORD` | Password for accessing a Docker registry requiring authentication. The default is only set if `$CS_IMAGE` resides at [`$CI_REGISTRY`](../../../ci/variables/predefined_variables.md). Not supported when [FIPS mode](../../../development/fips_compliance.md#enable-fips-mode) is enabled. |
+| `CS_REGISTRY_PASSWORD`         | `$CI_REGISTRY_PASSWORD` | Password for accessing a Docker registry requiring authentication. The default is only set if `$CS_IMAGE` resides at [`$CI_REGISTRY`](../../../ci/variables/predefined_variables.md). Not supported when [FIPS mode](../../../development/fips_compliance.md#enable-fips-mode) is enabled. |
 | `CS_REGISTRY_USER`                  | `$CI_REGISTRY_USER` | Username for accessing a Docker registry requiring authentication. The default is only set if `$CS_IMAGE` resides at [`$CI_REGISTRY`](../../../ci/variables/predefined_variables.md). Not supported when [FIPS mode](../../../development/fips_compliance.md#enable-fips-mode) is enabled. |
 | `CS_SEVERITY_THRESHOLD`        | `UNKNOWN`     | Severity level threshold. The scanner outputs vulnerabilities with severity level higher than or equal to this threshold. Supported levels are `UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, and `CRITICAL`. |
 | `CS_TRIVY_JAVA_DB`             | `"ghcr.io/aquasecurity/trivy-java-db"` | Specify an alternate location for the [trivy-java-db](https://github.com/aquasecurity/trivy-java-db) vulnerability database. |
 | `SECURE_LOG_LEVEL`             | `info`        | Set the minimum logging level. Messages of this logging level or higher are output. From highest to lowest severity, the logging levels are: `fatal`, `error`, `warn`, `info`, `debug`. |
-| `TRIVY_TIMEOUT`             | `5m0s`        | Set the timeout for the scan. |
+| `TRIVY_TIMEOUT`                | `5m0s`        | Set the timeout for the scan. |
 
-<ol>
-  <li>
-    <a id="notes-regarding-cs-ignore-statuses"></a>
-    <p>
-      Fix status information is highly dependent on accurate fix availability data from the software vendor and container image operating system package metadata. It is also subject to interpretation by individual container scanners. In cases where a container scanner misreports the availability of a fixed package for a vulnerability, using `CS_IGNORE_STATUSES` can lead to false positive or false negative filtering of findings when this setting is enabled.
-    </p>
-  </li>
-</ol>
+**Footnotes:**
+
+1. Fix status information is highly dependent on accurate fix availability data from the software
+   vendor and container image operating system package metadata. It is also subject to
+   interpretation by individual container scanners. In cases where a container scanner misreports
+   the availability of a fixed package for a vulnerability, using `CS_IGNORE_STATUSES` can lead to
+   false positive or false negative filtering of findings when this setting is enabled.
 
 ### Supported distributions
 
@@ -294,22 +315,6 @@ Container scanning of images in authenticated registries is not supported when [
 is enabled. When `CI_GITLAB_FIPS_MODE` is `"true"`, and `CS_REGISTRY_USER` or `CS_REGISTRY_PASSWORD` is set,
 the analyzer exits with an error and does not perform the scan.
 
-### Enable Container Scanning through an automatic merge request
-
-To enable Container Scanning in a project, create a merge request from the Security Configuration
-page:
-
-1. In the project where you want to enable Container Scanning, go to
-   **Secure > Security configuration**.
-1. In the **Container Scanning** row, select **Configure with a merge request**.
-
-This automatically creates a merge request with the changes necessary to enable Container Scanning.
-To complete the configuration, review and merge this merge request.
-
-The configuration tool works best with no existing `.gitlab-ci.yml` file, or with a minimal
-configuration file. If you have a complex GitLab configuration file, it may not be parsed
-successfully and an error may occur.
-
 ### Overriding the container scanning template
 
 If you want to override the job definition (for example, to change properties like `variables`), you
@@ -488,7 +493,7 @@ successfully run. For more information, see [Offline environments](../offline_de
 
 To use container scanning in an offline environment, you need:
 
-- GitLab Runner with the [`docker` or `kubernetes` executor](#prerequisites).
+- GitLab Runner with the [`docker` or `kubernetes` executor](#enabling-the-analyzer).
 - To configure a local Docker container registry with copies of the container scanning images. You
   can find these images in their respective registries:
 

doc/user/application_security/dependency_scanning/index.md

@@ -81,7 +81,7 @@ Dependency Scanning does not support runtime installation of compilers and inter
 
 ## Supported languages and package managers
 
-The following languages and dependency managers are supported when using the Dependency Scanning [CI Template](#enabling-the-analyzer-by-using-the-cicd-template):
+The following languages and dependency managers are supported by Dependency Scanning:
 
 <!-- markdownlint-disable MD044 -->
 <table class="ds-table">
@@ -678,7 +678,7 @@ Support for additional languages, dependency managers, and dependency files are
 Enable the dependency scanning analyzer to ensure it scans your application's dependencies for known
 vulnerabilities. You can then adjust its behavior by using CI/CD variables.
 
-### Enabling the analyzer by using the CI/CD template
+### Enabling the analyzer
 
 Prerequisites:
 
@@ -691,17 +691,38 @@ Prerequisites:
 To enable the analyzer, either:
 
 - Enable [Auto DevOps](../../../topics/autodevops/index.md), which includes dependency scanning.
-- Edit the `.gitlab-ci.yml` file manually. Use this method if your `.gitlab-ci.yml` file is complex.
 - Use a preconfigured merge request.
 - Create a [scan execution policy](../policies/scan-execution-policies.md) that enforces dependency
   scanning.
+- Edit the `.gitlab-ci.yml` file manually.
+- [Use CI/CD components](#use-cicd-components) (Android projects only)
+
+#### Use a preconfigured merge request
+
+This method automatically prepares a merge request that includes the Dependency Scanning template
+in the `.gitlab-ci.yml` file. You then merge the merge request to enable Dependency Scanning.
+
+NOTE:
+This method works best with no existing `.gitlab-ci.yml` file, or with a minimal configuration file.
+If you have a complex GitLab configuration file it might not be parsed successfully, and an error
+might occur. In that case, use the [manual](#edit-the-gitlab-ciyml-file-manually) method instead.
+
+To enable Dependency Scanning:
+
+1. On the left sidebar, select **Search or go to** and find your project.
+1. Select **Secure > Security configuration**.
+1. In the **Dependency Scanning** row, select **Configure with a merge request**.
+1. Select **Create merge request**.
+1. Review the merge request, then select **Merge**.
+
+Pipelines now include a Dependency Scanning job.
 
 #### Edit the `.gitlab-ci.yml` file manually
 
 This method requires you to manually edit the existing `.gitlab-ci.yml` file. Use this method if
 your GitLab CI/CD configuration file is complex.
 
-To enable dependency scanning:
+To enable Dependency Scanning:
 
 1. On the left sidebar, select **Search or go to** and find your project.
 1. Select **Build > Pipeline editor**.
@@ -726,36 +747,17 @@ To enable dependency scanning:
    merge request**.
 1. Review and edit the merge request according to your standard workflow, then select **Merge**.
 
-Pipelines now include a dependency scanning job.
-
-#### Use a preconfigured merge request
-
-This method automatically prepares a merge request that includes the dependency scanning template
-in the `.gitlab-ci.yml` file. You then merge the merge request to enable dependency scanning.
-
-NOTE:
-This method works best with no existing `.gitlab-ci.yml` file, or with a minimal configuration
-file. If you have a complex GitLab configuration file it might not be parsed successfully, and an
-error might occur. In that case, use the [manual](#edit-the-gitlab-ciyml-file-manually) method instead.
-
-To enable dependency scanning:
-
-1. On the left sidebar, select **Search or go to** and find your project.
-1. Select **Secure > Security configuration**.
-1. In the **Dependency Scanning** row, select **Configure with a merge request**.
-1. Select **Create merge request**.
-1. Review the merge request, then select **Merge**.
-
-Pipelines now include a dependency scanning job.
+Pipelines now include a Dependency Scanning job.
 
-### Enabling dependency scanning by using CI/CD components
+#### Use CI/CD components
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/454143) in GitLab 17.0. This feature is an [experiment](../../../policy/experiment-beta-support.md).
 > - The dependency scanning CI/CD component only supports Android projects.
 
-Use [CI/CD components](../../../ci/components/index.md) to perform dependency scanning of your application. For instructions, see the respective component's README file.
+Use [CI/CD components](../../../ci/components/index.md) to perform Dependency Scanning of your
+application. For instructions, see the respective component's README file.
 
-#### Available CI/CD components per language and package manager
+##### Available CI/CD components per language and package manager
 
 - [Android applications](https://gitlab.com/explore/catalog/components/android-dependency-scanning)
 
@@ -765,12 +767,12 @@ See [Use security scanning tools with merge request pipelines](../index.md#use-s
 
 ### Customizing analyzer behavior
 
-You can use CI/CD variables to customize dependency scanning behavior.
+To customize Dependency Scanning, use [CI/CD variables](#available-cicd-variables).
 
 WARNING:
-You should test all customization of GitLab security scanning tools in a merge request before
-merging these changes to the default branch. Failure to do so can give unexpected results,
-including a large number of false positives.
+Test all customization of GitLab analyzers in a merge request before merging these changes to the
+default branch. Failure to do so can give unexpected results, including a large number of false
+positives.
 
 ### Overriding dependency scanning jobs
 

doc/user/compliance/license_scanning_of_cyclonedx_files/index.md

@@ -31,7 +31,7 @@ No contextual information (for example, a list of project dependencies) is sent
 
 To enable License scanning of CycloneDX files:
 
-- Enable [Dependency Scanning](../../application_security/dependency_scanning/index.md#enabling-the-analyzer-by-using-the-cicd-template)
+- Enable [Dependency Scanning](../../application_security/dependency_scanning/index.md#enabling-the-analyzer)
   and ensure that its prerequisites are met.
 - On GitLab self-managed only, you can [choose package registry metadata to synchronize](../../../administration/settings/security_and_compliance.md#choose-package-registry-metadata-to-sync) in the Admin area for the GitLab instance. For this data synchronization to work, you must allow outbound network traffic from your GitLab instance to the domain `storage.googleapis.com`. If you have limited or no network connectivity then refer to the documentation section [running in an offline environment](#running-in-an-offline-environment) for further guidance.
 

ee/app/models/vulnerabilities/export/part.rb

@@ -2,7 +2,7 @@
 
 module Vulnerabilities
   class Export
-    class Part < ApplicationRecord
+    class Part < Gitlab::Database::SecApplicationRecord
       include FileStoreMounter
 
       self.table_name = "vulnerability_export_parts"

ee/spec/models/vulnerabilities/export/part_spec.rb

@@ -28,4 +28,11 @@
       expect(export_part.file.read).to eq("Hello World!")
     end
   end
+
+  context 'with loose foreign key on vulnerability_export_parts.organization_id' do
+    it_behaves_like 'cleanup by a loose foreign key' do
+      let_it_be(:parent) { create(:organization) }
+      let_it_be(:model) { create(:vulnerability_export_part, organization: parent) }
+    end
+  end
 end

lib/gitlab/verify/rake_task.rb

@@ -42,12 +42,12 @@ def say(text)
 
       def run_batch(range, failures)
         status_color = failures.empty? ? :green : :red
-        say "- #{range}: Failures: #{failures.count}".color(status_color)
+        say Rainbow("- #{range}: Failures: #{failures.count}").color(status_color)
 
         return unless verbose?
 
         failures.each do |object, error|
-          say "  - #{verifier.describe(object)}: #{error}".color(:red)
+          say Rainbow("  - #{verifier.describe(object)}: #{error}").color(:red)
         end
       end
     end

package.json

@@ -67,7 +67,7 @@
     "@gitlab/favicon-overlay": "2.0.0",
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/svgs": "3.105.0",
-    "@gitlab/ui": "^86.10.1",
+    "@gitlab/ui": "^86.11.0",
     "@gitlab/web-ide": "^0.0.1-dev-20240613133550",
     "@mattiasbuelens/web-streams-adapter": "^0.1.0",
     "@rails/actioncable": "7.0.8-4",

spec/lib/gitlab/database/no_cross_db_foreign_keys_spec.rb

@@ -32,7 +32,8 @@
       'subscription_user_add_on_assignments.user_id',         # https://gitlab.com/gitlab-org/gitlab/-/issues/444666
       'subscription_add_on_purchases.subscription_add_on_id', # https://gitlab.com/gitlab-org/gitlab/-/issues/444666
       'sbom_occurrences.source_package_id',                   # https://gitlab.com/groups/gitlab-org/-/epics/14116#identified-cross-joins
-      'sbom_occurrences.source_id'                            # https://gitlab.com/groups/gitlab-org/-/epics/14116#identified-cross-joins
+      'sbom_occurrences.source_id',                           # https://gitlab.com/groups/gitlab-org/-/epics/14116#identified-cross-joins
+      'vulnerability_export_parts.vulnerability_export_id'    # https://gitlab.com/groups/gitlab-org/-/epics/14197#cross-db-issues-to-be-resolved
     ]
   end
 

yarn.lock

@@ -1359,10 +1359,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.105.0.tgz#0d15978755093b79e5c9b883a27d8074bf316e9a"
   integrity sha512-JrXE7T3j+9FyQakG4XVg/uhXL3TZvmFgTuggaiSXdyelVOqAzYdPPm1oergdp8C+Io0zBKlLkJv/4nWG3AgkfQ==
-"@gitlab/ui@^86.10.1":
-  version "86.10.1"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-86.10.1.tgz#16463b1aff04683c62316b9c8b1a0e9e2917916f"
-  integrity sha512-LOV8HmZcgDTKq4/Yp45kncYjl20pTPWdhUWUwcTQlX6ewMYBkO/ip6wTLAQx7LVrBGXMlbHlk5PVbiwgatgulA==
+"@gitlab/ui@^86.11.0":
+  version "86.11.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-86.11.0.tgz#622fa5659f5ff241679efbc5cdad396807dff3b4"
+  integrity sha512-9+zZaKrpYySD3kkZFZ9ib/n8fAcavLZ2QC+9o5dvaKfQ54P4hRFQqUJpO6IXQufDAAkdBriPSw1RETa9lBkbpg==
   dependencies:
     "@floating-ui/dom" "1.4.3"
     echarts "^5.3.2"
@@ -13010,7 +13010,16 @@ string-length@^4.0.1:
     char-regex "^1.0.2"
     strip-ansi "^6.0.0"
-"string-width-cjs@npm:string-width@^4.2.0", string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
+"string-width-cjs@npm:string-width@^4.2.0":
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
+  integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
+  dependencies:
+    emoji-regex "^8.0.0"
+    is-fullwidth-code-point "^3.0.0"
+    strip-ansi "^6.0.1"
+
+string-width@^4.1.0, string-width@^4.2.0, string-width@^4.2.3:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/string-width/-/string-width-4.2.3.tgz#269c7117d27b05ad2e536830a8ec895ef9c6d010"
   integrity sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==
@@ -13062,7 +13071,7 @@ string_decoder@^1.0.0, string_decoder@^1.1.1, string_decoder@~1.1.1:
   dependencies:
     safe-buffer "~5.1.0"
-"strip-ansi-cjs@npm:strip-ansi@^6.0.1", strip-ansi@^6.0.0, strip-ansi@^6.0.1:
+"strip-ansi-cjs@npm:strip-ansi@^6.0.1":
   version "6.0.1"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
   integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
@@ -13076,6 +13085,13 @@ strip-ansi@^5.2.0:
   dependencies:
     ansi-regex "^4.1.0"
+strip-ansi@^6.0.0, strip-ansi@^6.0.1:
+  version "6.0.1"
+  resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.1.tgz#9e26c63d30f53443e9489495b2105d37b67a85d9"
+  integrity sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==
+  dependencies:
+    ansi-regex "^5.0.1"
+
 strip-ansi@^7.0.1, strip-ansi@^7.1.0:
   version "7.1.0"
   resolved "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.1.0.tgz#d5b6568ca689d8561370b0707685d22434faff45"
@@ -14762,7 +14778,7 @@ worker-loader@^3.0.8:
     loader-utils "^2.0.0"
     schema-utils "^3.0.0"
-"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0", wrap-ansi@^7.0.0:
+"wrap-ansi-cjs@npm:wrap-ansi@^7.0.0":
   version "7.0.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
   integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
@@ -14780,6 +14796,15 @@ wrap-ansi@^6.2.0:
     string-width "^4.1.0"
     strip-ansi "^6.0.0"
+wrap-ansi@^7.0.0:
+  version "7.0.0"
+  resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43"
+  integrity sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==
+  dependencies:
+    ansi-styles "^4.0.0"
+    string-width "^4.1.0"
+    strip-ansi "^6.0.0"
+
 wrap-ansi@^8.1.0:
   version "8.1.0"
   resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-8.1.0.tgz#56dc22368ee570face1b49819975d9b9a5ead214"