Skip to content

Dependency path to vulnerable dependencies by default

Fabien Catteau requested to merge dep-path-to-affected-pkg into master

What does this MR do?

Support 3 modes for how dependency paths are rendered:

  • no dependency path
  • dependency path to all dependencies
  • dependency path to vulnerable packages only

The default behavior changes from rendering the path to all dependencies to rendering the path for vulnerable dependencies only.

The strategy can be controlled via DS_DEPENDENCY_PATH_MODE. For now this experimental environment variable is NOT documented.

DS_DEPENDENCY_PATH_MODE can be set to all or none to force a particular mode, otherwise the default mode applies.

The goal is to better control the size and complexity of the reports Gemnasium generates.

What are the relevant issue numbers?

This relates to gitlab-org/gitlab#229840 (closed), though this issue has been closed.

Does this MR meet the acceptance criteria?

Edited by Fabien Catteau

Merge request reports