►
Description
This video and linked pages contain information related to upcoming products, features, and functionality.
It is important to note that the information presented is for informational purposes only. Please do not rely on this information for purchasing or planning purposes.
As with all projects, the items mentioned in this video and linked pages are subject to change or delay. The development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.
Chapters:
0:00 Disclaimer
0:28 Overview
1:50 Dependency Paths
3:05 SBOM MVC
4:37 Replace Licence Finder
6:14 Automatic Remediation Bot
7:03 Unordered List 1-5
11:28 Unordered List 6-10
15:50 Unordered List 11-15
23:57 Unordered List 16-22
31:09 Disclaimer again
A
My
name
is
nicole
schwartz
and
I'm
the
senior
product
manager
for
the
composition.
Analysis
group,
as
you
can
see,
on
the
disclaimer
I'm
about
to
talk
about
potential
future
roadmap
items,
don't
use
this
for
purchasing
or
planning.
This
is
just
things
that
I
would
like
to
do
in
the
coming
calendar
year.
A
We
do
have
suggested
solutions
right
now,
but
we
want
a
little
bot
to
make
the
mrs
things
that
we
need
to
maintain
doing.
We
always
do.
We
continue
to
need
to
do
latest
version
of
our
tools,
language
and
package
manager
updates
as
those
come
around
security
bugs
bugs
and
be
compliant
with
our
uptime
requirements.
A
Next,
in
an
unordered
list
is
a
whole
bunch
of
things
that
I
will
go
over
in
a
little
more
detail,
but
that's
kind
of
the
summary
lines
there
so
specifically
for
show
dependency
paths.
The
mvc
is
just
to
show
text
updates
of
a
short
path
and
a
long
path
and
make
that
available
on
the
vulnerability
details
page.
A
We
currently
have
that
kind
of
information
available
on
the
dependency
list
page
at
least
shortest,
but
we
need
to
be
consistent
about
wherever
you
go
to
look
at
your
vulnerability
and
dependency.
You
need
to
be
able
to
gather
more
information
about
it,
so
you
can
take
the
best
action
possible
and,
for
example,
see.
I
know
why
this
was
introduced.
Let
me
go
patch
that
thing
after
we
do
that.
Hopefully
we
can
do
another
content,
maturity
scorecard.
We
can
hopefully
just
reuse
the
exact
same
template.
A
We
did
previously
rerun
that
and
see
if
adding
that
mvc
of
dependency
paths
gets
us
to
complete
regardless
if
it
gets
us
to
complete
or
not,
we
need
to
work
on
the
post
mvc,
showing
the
graphical
dependency
path
that
may
require
us
to
do
additional
storage.
So
we'll
have
to
see
if
we
can
do
that
or
if
there's
some
pre-work
for
that.
A
A
Make
ux
updates
we're
doing
a
questionnaire
currently,
and
we
want
to
find
out
exactly
what
people
need,
but
we're
planning
a
whole
bunch
of
ux
updates
to
that
page,
which
could
include
renaming
it
from
the
dependency
list
to
the
s-bomb
to
be
determined
again.
S-Bomb
is
more
inclusive
than
just
your
dependencies,
but
that
is
an
element
of
it
and
we
want
to
support
an
industry
format
either
spdx
or
cyclone
dx
from
that
page
that
you
can
download
in
addition
to
our
internal
format.
A
What
is
in
your
software
and
just
not
making
it
chaos
and
siloed
for
licensed
compliance?
We
need
to
replace
license
finder
because
it
is
not
well
maintained
and
not
great
whatever
we
do
replace
it
with
needs
to
have
parity
with
license
finder
as
far
as
functionality,
languages,
package,
managers,
etc.
A
The
next
thing
that
I
want
to
do
as
soon
as
the
workspaces
is
ready,
which
is
hopefully
in
a
couple
releases,
is
to
move
our
allow
and
deny
policies
into
workspaces
and
security
orchestration.
If
sam
white
and
his
engineers
have
not
already
done
that
they
have
yay.
If
not,
then
we
will
do
that
then,
once
it's
there,
we
need
to
allow
those
policies
to
be
set
up
by
the
project,
subgroup
group
or
workspace
level.
A
Finally,
we
need
to
do
some
ux
improvements,
I'm
hoping
that
that's
part
of
the
s-bomb
research.
Otherwise
at
least
we
need
to
do
some
simplistic
ones
for
showing
the
allowed
or
unknown
or
denied
on
your
list
of
found
licenses,
and
then
I
do
believe
we
do
have
some
older
mocks
from
kyle,
so
we
can
surface
them
up
if
necessary.
A
So
the
next
thing
is
for
license
compliance
and
dependency
scanning
yep
that
should
actually
say
container
scanning.
Sorry,
I
will
update
that
slide
automatic
remediation.
We
want
the
bot
to
automatically
create
an
mr
for
the
suggested
solutions
that
are
available.
We
need
to
have
security,
do
a
audit
on
our
bot
before
we
can
release
it,
and
then
we
also
need
to
discuss
efficiencies
and
improvements
on
the
bot,
because
we
know
it
is
not
very
efficient
in
its
mvc
state.
A
A
A
I
would
like
automatic
remediation
to
expand
to
at
least
the
top
five
package
managers
and
languages
within
gitlab,
because
right
now
it's
a
very
limited
set.
So
if
we've
got
the
bot
out,
the
next
thing
is
obviously
going
to
be
like
hey.
The
bot
doesn't
work
for
my
language,
so
let's
aim
to
get
at
least
the
top
five
plus.
A
A
A
person's
project
should
then
use
the
most
recent
dependency
and
container
scans
artifacts
that
are
available
or
our
internal
s
bomber,
whatever
it
should
use
a
already
generated
resource
and
check
if
there
are
known
dependencies
that
have
newly
published
advisories
and
it
should
make
those
available
in
a
dashboard
or
in
some
way.
This
will
give
us
a
couple
benefits
one
for
people
who
don't
run
frequent
pipelines.
A
It
means
that
they
will
not
be
necessarily
missing
out
on
something
urgent.
It
also
means
that
a
developer,
who
is
the
first
person
to
run
an
mr
after
the
advisory's
database
is
updated,
will
not
be
confused
about.
Why
am
I
being
told
about
this
thing?
I
didn't
introduce
this
thing.
Yes,
they
didn't
introduce
that
thing.
A
A
A
We
also
need
to
make
some
enabling
the
ui
improvements.
Today
we
have
the
enable
using
a
merge
request-
very
simplistic,
whereas
sas
has
like
nice
things
where
a
lot
of
the
common
variables
are
given
like
drop,
downs
and
stuff
to
kind
of
help
or
hold
your
hand
through
that
process.
So
I'd
like
to
get
a
little
bit
closer
to
the
assassed
experience.
A
Formalize
a
support
standard.
We
have
discussed
this
off
and
on,
but
I
don't
think
that
we
formally
have
this
documented
or
agreed
on,
and
I
think
it
would
be
good
for
us
to
discuss
this
and
then
propose
it.
Do
all
of
secure
and
protect
and
see
if
we
can
unify
that
across
all
of
us
and
then
potentially
get
it
published
on
the
support
page
and
what
I
mean
by
that
is
that
maybe
secure
and
protect
will
aim
to
support
the
latest
lts's
within.
A
You
know,
90
days
of
their
introduction,
and
once
something
is
end
of
life
for
x
months.
We
will
no
longer
support
it.
Just
basically
around
what
kind
of
standards
do
we
want
to
transit
for
ourselves
as
far
as
languages
and
package
managers
that
we
are
going
to
support,
and
I
think
putting
that
together
at
least
internally
will
be
helpful
to
the
person
who
is
on
reaction
rotation
and
maybe
looking
to
see.
A
I
would
want
us
to
find
some
kind
of
open
source
project
that
does
this,
so
we're
not
having
to
maintain
it
ourselves
necessarily,
but
people
would
love
to
be
able
to
do
something
like
I
want
to
disallow
all
copy
lefts.
They
don't
want
to
pick
the
individual
licenses
that
they
wish
to
deny
within
their
projects.
They
want
to
pick
anything
within
a
certain
category,
so
just
smarter
or
more
comprehensive
rules,
and
so
that
we'd
have
to
find
some
kind
of
resource
that
somebody's,
hopefully
already
started.
A
Is
it
a
development
dependency
like
what
other
information
can
we
provide
to
help
people
when
they're
triaging
and
assessing
the
risk,
because
a
cvss
score
just
tells
you
in
the
default
situation
with
certain
assumptions?
What
is
the
risk?
But
by
giving
you
more
and
more
information,
you
may
be
able
to
quickly
say
in
my
specific
instance,
this
is
a
lower
risk,
because
you've
told
me
that
it's
a
dev
dependency
and
I
know
that
that
does
not
get
pushed
up
to
production.
So
I'm
not
worried
about
that
related
to
always
generating
reports.
A
A
I
would
have
all
package
managers
all
of
our
analyzers
for
license
compliance
and
dependency
scanning
configured
to
work
offline
with
test
projects
with
automated
tests
in
our
offline
environment,
so
kind
of
just
going
back
and
cleaning
that
up
and
tying
the
bow
on
everything
there
on
demand
scans.
I
would
love
to
follow
the
das
model
and
make
dependency
scanning
available
on
demand
to
customers.
A
Open
shift
revisit
all
analyzers,
so
we
should
hopefully
be
hiring
someone
who
is
interested
in
learning
about
openshift
and
that
person
will
be
responsible
for
kind
of
being
the
subject
matter:
expert
for
openshift
keeping
up
with
all
the
news
researching
things
across
all
of
secure,
protect
and
so
something
I
want
to
make
sure
that
they
do
is
finish
off.
Getting
all
package
managers
and
languages
across
license.
Compliance
and
dependency
scanning
working.
A
Make
sure
that
there's
video
demos
for
all
of
them
make
sure
there's
demo
project
and
environment
for
all
of
them,
work
with
quality
on
that
and
then
go
beyond
us
and
go
across
everyone
insecure
and
protect,
and
do
that
same
thing
once
that's
complete.
Hopefully,
that
won't
be
too
long
mixed
in
with
our
onboarding.
It
will
be,
I
suspect,
a
long
period
of
time,
but
not
that
long
relatively.
A
They
can
then
get
into
doing
the
normal
rotation
of
things,
but
when
an
open
shift
update
occurs,
they're
going
to
be
responsible
for
helping
get
that
updated
across
the
board
within
secure,
protect
package
hunter
look
into
bringing
that
in
is
supported
for
at
least
the
software
as
a
service
users.
Then
we
could
look
at
self-managed.
A
A
A
A
I
do
want
this
piece
of
mail
to
hang
around,
but
I
don't
necessarily
need
it
as
urgent,
so
I'm
going
to
set
up
a
ruler,
a
filter
for
this
piece
of
mail
and
I'm
going
to
say
always
mark
it
as
red
and
put
it
in
this
particular
folder.
Basically,
I
want
to
get
to
that
same
point
with
dependency
scanning
and
license
compliance.
It's
like
in
these
scenarios.
A
Yes
log.
This
make
sure
it's
in
that
audit
trail,
but
I
want
you
to
dismiss
it
or
resolve
it
or
whatever.
With
this
specific
note,
and
so
again
that
might
require
us
to
be
sending
or
providing
a
little
bit
more
data
in
the
report
so
that
this
can
be
actioned
on,
and
I
want
it
to
be
available
at
the
subgroup
group.
You
know
workspace
level.
A
A
My
personal
feelings
just
to
share
with
everyone
are
that
we
should
only
dedupe
when
we
absolutely
positively
know
that
it's
exactly
a
duplicate
in
other
cases.
I
think
we
should
be
doing
like
a
one-to-many
and
be
like
these
are
all
kind
of
related
and
we're
going
to
only
show
them
to
you
once
but
tell
you
like
there's
these
four
related
ones.
If
you
want
to
kind
of
close
one
of
them
but
keep
the
other
ones,
you
can
do
that
or
if
you
want
to
close
all
four
at
once,
you
can
also
do
that.
A
So
just
almost
allowing
users
to
kind
of
take
a
look
and
say,
we've
lumped
these
together
because
we
feel,
if
you
solve
this
one
problem.
These
are
all
related
or
very,
very
similar
dust
is
doing
something
similar-ish,
but
right
now,
they're
aggregating
them
all
pre-order
them.
As
a
finding
and
saying
this
particular
thing
is
found
for
all
of
these
website
pages,
because
it's
really
hard
for
them
to
tell
on
the
back
end
is
that
one
function
or
two?
So
in
our
case
I
want
us
to
to
group
it
by
default.
A
People
could
turn
that
off
potentially
and
then
like
tell
them
like
we
found
these
other
three
things,
and
so,
if
you
dismiss
this,
we're
going
to
dismiss
all
of
them
because
we
think
they're
related.
Unless
you
want
to
click
this,
like
uncombine
button
or
whatever
I
don't
know
who
knows
this
needs
to
be
explored,
talked
out
I'd
love
to
hear
everybody
else's
thoughts.
A
A
We
would
love
to
have
a
database
where
we
store
all
sorts
of
metadata
about
dependencies
like
generic
dependencies,
not
any
particular
individual
companies
dependencies.
Just
generic
internet
dependencies
is
it
end
of
life.
What
is
the
most
recent
version?
How
often
do
they
publish
updates?
How
many
maintainers
are
there?
What
countries
are
the
maintainers
and
all
sorts
of
other
information?
A
What
is
the
publicly
known,
hash
or
signature
or
whatever,
and
allow
then
customers
to
set
policies
where
I
want
you
to
alert
me
if
one
of
my
dependencies
is
now
end
of
life,
which
gets
into
that
whole
cheap
scan
concept,
where
you
know
like
the
bot,
is
doing
something
at
a
regular
interval
and
checking
for
stuff.
That
may
be
a
new
piece
of
data
in
the
risk
database
or
the
advisory's
database,
but
not
necessarily
needing
to
run
a
pipeline
scan
and
being
able
to
reference
our
internal
s-bom
or
reports.
A
A
I
want
risk
and
policy
to
to
work
together,
and
then
this
probably
we
should
be
working
with
the
compliance
team
as
well
on
this
just
so
that
you
know
smoothly
across
the
development
experience
all
of
the
people
who
have
to
interact
with
the
software
team,
the
legal
team,
the
compliance
teams,
the
security
teams
can
be
able
to
set
up
policies
and
whether
they
want
I
I
want
this
to
be.
You
know
require
someone
to
approve
this
and
then
hopefully
we
can
work
with
other
teams
within
gitlab.
A
A
Next
item
is
search
and
filter.
We
need
to
definitely
add,
searching
and
filtering
to
the
dependency
list
and
the
license
list.
We
possibly
need
to
also
make
enhancements
to
the
volume
list
that
requires
us
having
potentially
the
workspaces
stuff,
because
you
know
people
want
to
do
that,
possibly
able
to
store
additional
stuff.
I
don't
know
what
prereqs
there
are
there.
We're
definitely
going
to
have
to
make
some
additions
on
the
back
end,
because
front
end
indicated
that
they
cannot
do
that.
A
Just
on
the
front
end
right
now
we're
lacking
some
data
on
the
back
end,
but
we
need
to
add,
searching
and
filtering
to
all
of
those
spots
for
dependencies
and
licenses
s
bomb
post
mvc.
So
you
know
the
mvc
was
default
branch
be
able
to
download
it
from
the
dependency
list
page
generate
it
on.
You
know
a
certain
condition
and
store
it
for
a
certain
time
to
live
in
one
industry,
format,
either
cyclone
or
spdx.
A
So
I
know
that
my
s-bomb
for
this
code
that
I
have
included
as
a
bundled
file
is
x.
Let
me
include
that
s-bond
file
and
point
to
it
and
have
that
then
be
consumed
and
part
of
my
dependency
software
s-bomb,
and
maybe
we
could
also
put
it
like
standalone
lock
file.
I
don't
know
if
that's
possible,
if
maybe
I
built
something
in
a
separate
project
and
this
other
project's
doing
the
build
like.
A
Unification
of
package
managers,
dependency
standing
and
license
compliance
right.
Now
we
kind
of
have
like
a
little
bit
of
mismatch
on
like
what
we
support
between
them.
So
I
would
love
for
us
to
get
unification
there
in
in
so
far
as,
let's
add
more
not
take
away
any
then
the
other
thing
is
once
we
get
some
unification
there.
A
All
of
our
work
into
the
workspaces
model
thing
stuff
so
that
we
can
leverage
that
the
idea
there
is
that,
instead
of
having
to
rewrite
something
at
the
project
level
and
at
the
group
level
and
at
the
instance
level,
you
write
it
once
and
it
should
work
for
all
of
them.
There's
a
youtube
unfiltered
with
a
read
somewhere.
A
Just
look
for
workspaces,
there's
like
an
ama
or
whatever.
So
you
can
check
that
out.
I
think
it
is
still
in
flux
and
happening,
but
the
initial
mvc
for
the
project
level
is
getting
ourselves
into
that.
Namespace
container
should
be
available
soon.
So
I
want
to
make
sure
we
are
taking
all
of
our
old
stuff
and
putting
it
in
there
as
we're
writing
stuff
putting
that
in
there,
and
I
believe,
that's
it
so
there's
your
disclaimer
again.
A
I
know
that
is
way
more
than
is
gonna
fit
in
the
next
calendar
year.
I
just
wanted
to
give
you
all
an
idea
of
the
things
that
I
am
keeping
an
eye
on
and
I
am
trying
to
balance
and
prioritize
we'll
consider
this
a
draft
run.
Y'all
can
ask
me
questions.
I
have
to
update
a
couple
of
the
slides
and
whatever,
obviously,
because
I
made
some
mistakes
I'll,
try
and
put
time
stamps
in
so
you
can
jump
around.