## Problem to Solve Following the foundation laid with https://gitlab.com/groups/gitlab-org/-/epics/7886+, moving toward vulnerability scanning executed outside of the pipeline and based on components provided in an SBOM present several challenges. These challenges must be identified and possibly addressed before we can retire the existing solution that execute the vulnerability scan within the CI job. NOTE: the epic initially covered Container Scanning too but as been rescoped to only focus on Dependency Scanning. ## Outcomes for the purpose of Gemnasium deprecation 1. [auto-remediation](#note_1603090833). - Will do in: https://gitlab.com/groups/gitlab-org/-/epics/759+ - Delivery required by milestone: n/a 2. [dependency graph](#note_1587405577) - Will do in: https://gitlab.com/groups/gitlab-org/-/epics/7288+ - Delivery required by milestone: %"17.9" 3. [custom advisory DB source](#note_1587399204) - Will not do. This is not a user-facing feature. 4. [Security scan results are no longer available in the form of CI Job artifacts](#note_1584984786) - Will do in: https://gitlab.com/groups/gitlab-org/-/epics/14636+ - Delivery required by milestone: %"17.9" 5. [Porting analyzer options that impact security results](#note_1584668605) - Will do in: https://gitlab.com/gitlab-org/gitlab/-/issues/476224+ - Delivery required by milestone: %"17.9" 6. [Scanning of vendored JavaScript libraries](https://gitlab.com/gitlab-org/gitlab/-/issues/475275#note_2024828987) - Will do in: https://gitlab.com/groups/gitlab-org/-/epics/7186+ - Delivery required by milestone: ideally %"18.0", fast follow-up otherwise ## Audit - https://gitlab.com/gitlab-org/gitlab/-/issues/475275+