GitLab native support for vulnerability alerts #45058
Closed
jrinaudo-gitlab
started this conversation in
Suggest an Idea
Replies: 3 comments 2 replies
|
Sounds like a plan - do we have example(s) for what the API responses look like on a real repo? (Note to self: #44153 will be a prereq) |
2 replies
|
Project.vulnerabilities and Project.dependencies. Also may be useful Project.dependencyPaths. I can provide real-valid examples if needed from a demo project but If you have a GitLab environment where these features are enabled you can also use https://gitlab.com/-/graphql-explorer to test manually. |
|
If you wouldn't mind sharing some real examples that'd be useful, thanks! I don't think I have any projects handy that have it enabled |
|
https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts: query getProjectVulnerabilities($fullPath: ID!) {
project(fullPath: $fullPath) {
vulnerabilities {
nodes {
id
title
severity
state
reportType
detectedAt
webUrl
identifiers {
externalType
externalId
name
}
}
}
}
}Shows: {
"data": {
"project": {
"vulnerabilities": {
"nodes": [
{
"id": "gid://gitlab/Vulnerability/364961670",
"title": "find-my-way: DDoS with HTTP2",
"severity": "HIGH",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961670",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "b7a28b9b-46eb-4195-a704-d712a057f54a",
"name": "Gemnasium-b7a28b9b-46eb-4195-a704-d712a057f54a"
},
{
"externalType": "cve",
"externalId": "CVE-2026-47219",
"name": "CVE-2026-47219"
},
{
"externalType": "ghsa",
"externalId": "GHSA-c96f-x56v-gq3h",
"name": "GHSA-c96f-x56v-gq3h"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961666",
"title": "path-to-regexp outputs backtracking regular expressions",
"severity": "HIGH",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961666",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "ac35759c-542a-402e-82b8-f094fb1b4a96",
"name": "Gemnasium-ac35759c-542a-402e-82b8-f094fb1b4a96"
},
{
"externalType": "ghsa",
"externalId": "GHSA-9wv6-86v2-598j",
"name": "GHSA-9wv6-86v2-598j"
},
{
"externalType": "cve",
"externalId": "CVE-2024-45296",
"name": "CVE-2024-45296"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961663",
"title": "Withdrawn Advisory: fast-redact vulnerable to prototype pollution",
"severity": "HIGH",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961663",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "db9d50d3-7f30-4187-93da-f558f2f485b5",
"name": "Gemnasium-db9d50d3-7f30-4187-93da-f558f2f485b5"
},
{
"externalType": "cve",
"externalId": "CVE-2025-57319",
"name": "CVE-2025-57319"
},
{
"externalType": "ghsa",
"externalId": "GHSA-ffrw-9mx8-89p8",
"name": "GHSA-ffrw-9mx8-89p8"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961662",
"title": "Improper Check for Unusual or Exceptional Conditions",
"severity": "HIGH",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961662",
"identifiers": [
{
"externalType": "ghsa",
"externalId": "GHSA-455w-c45v-86rg",
"name": "GHSA-455w-c45v-86rg"
},
{
"externalType": "cve",
"externalId": "CVE-2022-39288",
"name": "CVE-2022-39288"
},
{
"externalType": "gemnasium",
"externalId": "99167607-bf1f-4e39-b491-7f3510486b3e",
"name": "Gemnasium-99167607-bf1f-4e39-b491-7f3510486b3e"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961660",
"title": "Fastify's Content-Type header tab character allows body validation bypass",
"severity": "HIGH",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961660",
"identifiers": [
{
"externalType": "ghsa",
"externalId": "GHSA-jx2c-rxcm-jvmq",
"name": "GHSA-jx2c-rxcm-jvmq"
},
{
"externalType": "cve",
"externalId": "CVE-2026-25223",
"name": "CVE-2026-25223"
},
{
"externalType": "gemnasium",
"externalId": "eaf1b6bb-398c-498a-87bf-52a4f6c7de87",
"name": "Gemnasium-eaf1b6bb-398c-498a-87bf-52a4f6c7de87"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961669",
"title": "send vulnerable to template injection that can lead to XSS",
"severity": "MEDIUM",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961669",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "902b30dd-22be-429c-a3eb-1200a055f31b",
"name": "Gemnasium-902b30dd-22be-429c-a3eb-1200a055f31b"
},
{
"externalType": "cve",
"externalId": "CVE-2024-43799",
"name": "CVE-2024-43799"
},
{
"externalType": "ghsa",
"externalId": "GHSA-m6fv-jmcg-4jfg",
"name": "GHSA-m6fv-jmcg-4jfg"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961668",
"title": "Uncontrolled Resource Consumption",
"severity": "MEDIUM",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961668",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "671351c4-9933-4738-bfe4-d81bab43b44e",
"name": "Gemnasium-671351c4-9933-4738-bfe4-d81bab43b44e"
},
{
"externalType": "cve",
"externalId": "CVE-2020-8192",
"name": "CVE-2020-8192"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961667",
"title": "URL Redirection to Untrusted Site ('Open Redirect')",
"severity": "MEDIUM",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961667",
"identifiers": [
{
"externalType": "cve",
"externalId": "CVE-2021-22963",
"name": "CVE-2021-22963"
},
{
"externalType": "ghsa",
"externalId": "GHSA-p6vg-p826-qp3v",
"name": "GHSA-p6vg-p826-qp3v"
},
{
"externalType": "gemnasium",
"externalId": "7c19bf24-fe12-46df-99d1-4b4d60e4125c",
"name": "Gemnasium-7c19bf24-fe12-46df-99d1-4b4d60e4125c"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961665",
"title": "Insufficient Verification of Data Authenticity",
"severity": "MEDIUM",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961665",
"identifiers": [
{
"externalType": "ghsa",
"externalId": "GHSA-v5vr-h3xq-8v6w",
"name": "GHSA-v5vr-h3xq-8v6w"
},
{
"externalType": "gemnasium",
"externalId": "e27c266d-4140-4ad0-b718-8c166ce56e91",
"name": "Gemnasium-e27c266d-4140-4ad0-b718-8c166ce56e91"
},
{
"externalType": "cve",
"externalId": "CVE-2022-29220",
"name": "CVE-2022-29220"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961664",
"title": "fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections",
"severity": "MEDIUM",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961664",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "9e56a408-6f58-42fb-8b13-96e31ed5001e",
"name": "Gemnasium-9e56a408-6f58-42fb-8b13-96e31ed5001e"
},
{
"externalType": "cve",
"externalId": "CVE-2026-3635",
"name": "CVE-2026-3635"
},
{
"externalType": "ghsa",
"externalId": "GHSA-444r-cwp2-x5xf",
"name": "GHSA-444r-cwp2-x5xf"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961659",
"title": "Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStream",
"severity": "LOW",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961659",
"identifiers": [
{
"externalType": "gemnasium",
"externalId": "3b6283b3-8128-45ab-97cd-af677b4b10d8",
"name": "Gemnasium-3b6283b3-8128-45ab-97cd-af677b4b10d8"
},
{
"externalType": "cve",
"externalId": "CVE-2026-25224",
"name": "CVE-2026-25224"
},
{
"externalType": "ghsa",
"externalId": "GHSA-mrq3-vjjr-p77c",
"name": "GHSA-mrq3-vjjr-p77c"
}
]
},
{
"id": "gid://gitlab/Vulnerability/364961661",
"title": "cookie accepts cookie name, path, and domain with out of bounds characters",
"severity": "UNKNOWN",
"state": "DETECTED",
"reportType": "DEPENDENCY_SCANNING",
"detectedAt": "2026-08-26T15:26:13Z",
"webUrl": "https://gitlab.com/tanna.dev/renovate-testing/rnv-gitlab-vulnerability-alerts/-/security/vulnerabilities/364961661",
"identifiers": [
{
"externalType": "ghsa",
"externalId": "GHSA-pxg6-pf52-xh8x",
"name": "GHSA-pxg6-pf52-xh8x"
},
{
"externalType": "gemnasium",
"externalId": "c560c096-ab9d-4bf2-92ca-69ec73ef8ed0",
"name": "Gemnasium-c560c096-ab9d-4bf2-92ca-69ec73ef8ed0"
},
{
"externalType": "cve",
"externalId": "CVE-2024-47764",
"name": "CVE-2024-47764"
}
]
}
]
}
}
},
"extensions": {
"disabled_filters": []
},
"correlationId": "a313daa83d4fd6bf-IAD"
} |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Tell us more.
Extend Renovate’s existing
vulnerabilityAlertssupport to also consume GitLab-native vulnerability alerts, so GitLab projects receive targeted security-fix MRs in the same way GitHub users do today. These MRs should honor the existingvulnerabilityAlertsconfiguration (for examplelabels,automerge,schedule,minimumReleaseAge) and bypass normal rate limits and schedules so that security fixes are never queued behind routine updates.Use GitLab’s Vulnerability report and Dependency list as primary data sources: cross-reference vulnerabilities surfaced in the Vulnerability report with components in the Dependency list to identify vulnerable, Renovate-managed dependencies and automatically propose version bumps that remediate those findings.
All reactions