Skip to content

Bump SAST Analyzer major version for 17.0 and remove deprecated analyzers

Why are we doing this work?

Version 4 of all SAST analyzers has been deprecated. The analyzers that will not be removed in 17.0 must be bumped to the next major version.

Analyzers to bump from v4 to v5:

The version must be updated in:

The jobs for the analyzers that are to be removed should also be updated so that they no longer run be default.

The jobs should be updated in the following way

nodejs-scan-sast:
  extends: .sast-analyzer
  script:
    - echo "This job was deprecated in GitLab 16.8 and removed in GitLab 17.0"
    - echo "For more information see https://docs.gitlab.com/ee/update/deprecations.html#sast-analyzer-coverage-changing-in-gitlab-170"
    - exit 1
  rules:
    - when: never

The analyzers to be removed are:

  • flawfinder
  • nodejs scan
  • phpcs
  • brakeman
  • mobsf-android-sast
  • mobsf-ios-sast
  • Remove kotlin from spotbugs job

The analyzer should be removed from:

Relevant links

#438123 (closed)

Implementation Plan

Edited by Craig Smith