[{"data":1,"prerenderedAt":1256},["ShallowReactive",2],{"/blog/the-ultimate-guide-to-sboms":3,"navigation-en-us":460,"banner-en-us":887,"footer-en-us":897,"blog-post-authors-en-us-Joel Krooswyk|Elisabeth Burrows":1141,"blog-related-posts-en-us-the-ultimate-guide-to-sboms":1168,"blog-promotions-en-us":1193,"next-steps-en-us":1246},{"id":4,"title":5,"authors":6,"body":9,"category":436,"date":437,"description":438,"extension":439,"externalUrl":440,"faq":440,"featured":441,"heroImage":442,"meta":443,"navigation":444,"path":445,"seo":446,"slug":450,"stem":451,"tags":452,"template":457,"updatedDate":458,"__hash__":459},"blogPosts/en-us/blog/the-ultimate-guide-to-sboms.md","The ultimate guide to SBOMs",[7,8],"Joel Krooswyk","Elisabeth Burrows",{"type":10,"value":11,"toc":417},"minimark",[12,23,26,29,34,37,52,56,65,68,71,76,90,111,115,118,125,129,137,152,156,159,163,166,187,208,212,221,225,240,255,276,280,283,287,294,304,308,313,316,321,324,352,357,360,372,375,380,383,409,414],[13,14,15,16,22],"p",{},"In March 2026, four ",[17,18,21],"a",{"href":19,"rel":20},"https://about.gitlab.com/blog/pipeline-security-lessons-from-march-supply-chain-incidents/",[],"supply chain attacks"," unfolded in 12 days, compromising tools trusted by millions of development teams, including a vulnerability scanner, an infrastructure security scanner, an AI model gateway, and one of the most widely used HTTP clients in the JavaScript ecosystem. In each case, the attack surface was the same: the dependencies flowing through CI/CD pipelines.",[13,24,25],{},"Most of those organizations were running security tools. What they couldn't see was what was inside the packages those tools depended on.",[13,27,28],{},"That visibility starts with a software bill of materials, or SBOM.",[30,31,33],"h2",{"id":32},"what-is-an-sbom","What is an SBOM?",[13,35,36],{},"An SBOM is a complete inventory of every library and component your software is built from. Without it, you can't know what you're running. With it, you can find vulnerabilities, manage risk, and respond when something in your dependency chain is compromised.",[13,38,39,40,45,46,51],{},"Common formats support interoperability across tools and teams, including ",[17,41,44],{"href":42,"rel":43},"https://cyclonedx.org/capabilities/sbom/",[],"CycloneDX",", an Ecma International standard (ECMA-424), and ",[17,47,50],{"href":48,"rel":49},"https://spdx.dev/",[],"SPDX",", an ISO standard (ISO/IEC 5962:2021). GitLab generates SBOMs with CycloneDX; organizations requiring SPDX can convert between formats using open source tools like cyclonedx-cli.",[30,53,55],{"id":54},"why-sboms-matter","Why SBOMs matter",[13,57,58,59,64],{},"Third-party code and open source code now account for 80% to 90% of modern applications, according to Sonatype's 2026 State of the Software Supply Chain ",[17,60,63],{"href":61,"rel":62},"https://www.sonatype.com/state-of-the-software-supply-chain/introduction",[],"report",". Yet in 95% of cases where a vulnerable component is downloaded, a fixed version already exists. The gap is knowing what you're running, not available patches.",[13,66,67],{},"An SBOM gives teams a complete, auditable view of everything an organization's software is built from, down to the deeply nested transitive dependencies. When a component in your dependency chain is compromised, you can trace exposure across affected projects in minutes instead of hours.",[13,69,70],{},"In addition, AI has shortened the window between vulnerability discovery and active exploitation. Researchers and attackers can now surface zero-days in open source components in hours, not months. Without an SBOM, you have no reliable way of knowing which projects are exposed when a new advisory lands.",[72,73,75],"h3",{"id":74},"sbom-requirements-are-shifting-but-risk-isnt","SBOM requirements are shifting but risk isn't",[13,77,78,79,84,85,89],{},"SBOMs have moved from recommended practice to regulatory expectation, and back again. In January 2026, the U.S. Office of Management and Budget (OMB) ",[17,80,83],{"href":81,"rel":82},"https://www.whitehouse.gov/wp-content/uploads/2026/01/M-26-05-Adopting-a-Risk-based-Approach-to-Software-and-Hardware-Security.pdf",[],"rescinded"," M-22-18, the Biden-era mandate requiring software vendors selling to the federal government to provide SBOM attestations. Its replacement, ",[17,86,88],{"href":81,"rel":87},[],"M-26-05",", takes a risk-based approach that lets agencies define their own software assurance requirements.",[13,91,92,93,98,99,104,105,110],{},"SBOMs are no longer a blanket federal requirement, but they remain a recognized best practice and an enforcement tool agencies can still use. Frameworks like ",[17,94,97],{"href":95,"rel":96},"https://www.pcisecuritystandards.org/standards/pci-dss/",[],"PCI DSS 4.0",", U.S. Food and Drug Administration  guidance, ",[17,100,103],{"href":101,"rel":102},"https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity",[],"EO 14028",", and U.S. Army directives already require them, and the ",[17,106,109],{"href":107,"rel":108},"https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act",[],"EU's Cyber Resilience Act"," makes them a hard requirement for products sold in European markets.",[30,112,114],{"id":113},"gitlab-sbom-support","GitLab SBOM support",[13,116,117],{},"An SBOM that isn't updated with every change is already out of date when a new vulnerability lands. GitLab generates SBOMs inside the pipeline. The inventory updates with every commit, vulnerability matches run automatically as new advisories are published, and findings surface where developers already work.",[13,119,120],{},[121,122],"img",{"alt":123,"src":124},"Listing of how GitLab supports SBOMs","https://res.cloudinary.com/about-gitlab-com/image/upload/v1782392277/an5uvhtmqspaf2v7xpkh.png",[72,126,128],{"id":127},"scale-sbom-generation-and-management","Scale SBOM generation and management",[13,130,131,136],{},[17,132,135],{"href":133,"rel":134},"https://about.gitlab.com/blog/sbom-based-dependency-scanning/",[],"GitLab's SBOM-based dependency scanning analyzer",", generally available in GitLab 19.0, supports 24+ package ecosystems. It parses lockfiles and dependency graphs directly rather than replicating each package manager's build toolchain, which makes scanning faster and extends language coverage without analyzer rebuilds.",[13,138,139,140,145,146,151],{},"Every scan produces a CycloneDX SBOM artifact. The ",[17,141,144],{"href":142,"rel":143},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"dependency list"," is ",[17,147,150],{"href":148,"rel":149},"https://docs.gitlab.com/api/dependency_list_export/",[],"exportable"," in CycloneDX, JSON, or CSV formats directly from the UI, a specific pipeline, or via the GitLab API, so you can share SBOMs with customers, auditors, or downstream tooling. You can filter by component name and version, including multiple versions at once, to quickly surface which projects are running a specific dependency — critical when a compromised version needs to be identified and rotated across an organization.",[72,153,155],{"id":154},"ingest-and-merge-sboms","Ingest and merge SBOMs",[13,157,158],{},"For projects with multiple components, a CI/CD job can merge multiple CycloneDX SBOMs into one consolidated file, with duplicate entries removed using implementation-specific metadata such as build and lock file locations. The merged SBOM is automatically augmented with license and vulnerability data for every component it contains.",[72,160,162],{"id":161},"mitigate-vulnerabilities-faster-to-improve-code-security","Mitigate vulnerabilities faster to improve code security",[13,164,165],{},"Knowing which vulnerabilities matter and fixing them fast is where most teams struggle. GitLab addresses both.",[13,167,168,169,174,175,180,181,186],{},"For prioritization, vulnerability risk scoring incorporates ",[17,170,173],{"href":171,"rel":172},"https://docs.gitlab.com/user/application_security/vulnerabilities/risk_assessment_data/",[],"EPSS"," (Exploit Prediction Scoring System), KEV (Known Exploited Vulnerabilities), and ",[17,176,179],{"href":177,"rel":178},"https://nvd.nist.gov/vuln-metrics/cvss",[],"CVSS"," (Common Vulnerability Scoring System) data, so teams triage based on real-world exploitability rather than theoretical severity. ",[17,182,185],{"href":183,"rel":184},"https://docs.gitlab.com/user/application_security/dependency_scanning/static_reachability/",[],"Static reachability analysis"," for Java, JavaScript/TypeScript, and Python projects examines call graphs to identify which vulnerable dependencies are invoked at runtime. The dependency list shows whether each vulnerability sits in a direct or transitive dependency, with the full path showing how it entered the project.",[13,188,189,190,195,196,201,202,207],{},"Every confirmed finding comes with context: what it is, how it can be exploited, and how to fix it. Engineers can triage, assess, and ",[17,191,194],{"href":192,"rel":193},"https://docs.gitlab.com/user/duo_agent_platform/agents/foundational_agents/security_analyst_agent/",[],"guide"," remediation in natural language directly in chat, without switching to external dashboards or scripts. For confirmed SAST vulnerabilities, ",[17,197,200],{"href":198,"rel":199},"https://docs.gitlab.com/user/application_security/vulnerabilities/agentic_vulnerability_resolution/",[],"agentic remediation"," runs automatically — analyzing the finding, reasoning through the surrounding code, generating a fix, and opening a ready-to-merge request without manual intervention. Teams can also create and enforce ",[17,203,206],{"href":204,"rel":205},"https://docs.gitlab.com/user/application_security/policies/vulnerability_management_policy/",[],"policies"," based on newly detected vulnerabilities, so findings drive action instead of accumulating in a backlog.",[72,209,211],{"id":210},"understand-license-compliance","Understand license compliance",[13,213,214,215,220],{},"SBOMs aren't only a security artifact. Legal, procurement, and compliance teams use them to understand the licensing terms of every component in a product and whether those terms align with corporate policy. GitLab surfaces ",[17,216,219],{"href":217,"rel":218},"https://docs.gitlab.com/user/compliance/license_scanning_of_cyclonedx_files/",[],"license data"," alongside vulnerability findings in the dependency list, so non-security stakeholders can assess compliance exposure.",[72,222,224],{"id":223},"enforce-continuous-dependency-scanning","Enforce continuous dependency scanning",[13,226,227,228,233,234,239],{},"Most vulnerability scanners only run when code changes. GitLab ",[17,229,232],{"href":230,"rel":231},"https://docs.gitlab.com/user/application_security/continuous_vulnerability_scanning/",[],"Continuous Vulnerability Scanning"," runs independently of pipelines — when new CVEs are published to ",[17,235,238],{"href":236,"rel":237},"https://advisories.gitlab.com/",[],"GitLab's Advisory Database",", every project with dependency or container scanning enabled is automatically checked against the new advisory, with no commit or pipeline trigger required. This is particularly valuable for dormant or deprioritized repositories — projects where active development has stopped but the code remains in use.",[13,241,242,243,248,249,254],{},"The ",[17,244,247],{"href":245,"rel":246},"https://about.gitlab.com/blog/track-vulnerability-remediation-with-the-updated-gitlab-security-dashboard/",[],"GitLab Security Dashboard"," consolidates findings across projects, groups, and business units into a single view, with charts for open vulnerabilities, remediation velocity, and risk score over time. A ",[17,250,253],{"href":251,"rel":252},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"Vulnerabilities by Age chart"," surfaces how long issues have been open and unresolved, which makes it harder for findings to quietly age out of sight.",[13,256,257,258,263,264,269,270,275],{},"Every build artifact produced by GitLab ships with signed provenance, generated in-pipeline with no external signing service in the chain. This architecture enables ",[17,259,262],{"href":260,"rel":261},"https://about.gitlab.com/blog/achieve-slsa-level-2-compliance-with-gitlab/",[],"SLSA"," Level 1 and Level 2 compliance, because the provenance is generated and signed by the same trusted builder that produced the artifact, with no third-party involvement that could introduce tampering risk. GitLab also supports SLSA Level 1 compliance through ",[17,265,268],{"href":266,"rel":267},"https://docs.gitlab.com/ci/components/",[],"CI/CD components"," that use ",[17,271,274],{"href":272,"rel":273},"https://docs.sigstore.dev/cosign/",[],"Sigstore Cosign"," to sign and verify artifact provenance, giving downstream consumers cryptographic proof of what was built, where, and how.",[30,277,279],{"id":278},"the-future-of-gitlabs-sbom-functionality","The future of GitLab's SBOM functionality",[13,281,282],{},"SBOMs are central to GitLab's software supply chain direction, and GitLab continues to improve its dependency scanning capabilities. We're working toward deeper integration of SBOM data across the software development lifecycle: expanding language coverage, strengthening agentic remediation, and surfacing SBOM-driven insights earlier in development, so teams can act on supply chain risk before it reaches production.",[30,284,286],{"id":285},"get-started-with-sboms","Get started with SBOMs",[13,288,289,290,293],{},"Under ",[17,291,88],{"href":81,"rel":292},[],", the federal government replaced its blanket SBOM mandate with an approach that lets agencies define their own software assurance requirements. Many will still require SBOMs from vendors. If you build SBOM capabilities into your workflows now, you'll be better positioned to respond when incidents occur and to satisfy whatever requirements agencies impose.",[295,296,297],"blockquote",{},[13,298,299],{},[17,300,303],{"href":301,"rel":302},"https://gitlab.com/-/trials/new",[],"Start a free trial of GitLab Ultimate.",[30,305,307],{"id":306},"sbom-faq","SBOM FAQ",[13,309,310],{},[311,312,33],"strong",{},[13,314,315],{},"An SBOM is a complete, machine-readable inventory of every component inside an application, including open-source libraries, third-party dependencies, the versions you're running, and the licenses attached to each.",[13,317,318],{},[311,319,320],{},"Why are SBOMs important?",[13,322,323],{},"SBOMs are crucial for several reasons. They provide:",[325,326,327,334,340,346],"ul",{},[328,329,330,333],"li",{},[311,331,332],{},"Insight into dependencies",": Understanding what makes up your software helps identify and mitigate risks from third-party components.",[328,335,336,339],{},[311,337,338],{},"Enhanced security",": With detailed visibility into application components, organizations can pinpoint vulnerabilities quickly and take steps to address them.",[328,341,342,345],{},[311,343,344],{},"Regulatory compliance",": Regulations and best practices increasingly recommend or require an SBOM, particularly in the public sector.",[328,347,348,351],{},[311,349,350],{},"Streamlined development",": Developers can use an SBOM to see which libraries and components are in use, saving time and reducing errors.",[13,353,354],{},[311,355,356],{},"What standards are used for SBOM data exchange?",[13,358,359],{},"Two standards dominate:",[325,361,362,367],{},[328,363,364,366],{},[311,365,44],{},": Known for its user-friendly approach, CycloneDX simplifies complex relationships between software components and supports specialized use cases.",[328,368,369,371],{},[311,370,50],{},": Another widely used framework for SBOM data exchange, providing detailed information about components within the software environment.",[13,373,374],{},"GitLab uses CycloneDX for SBOM generation because of its prescriptive nature and extensibility to future needs.",[13,376,377],{},[311,378,379],{},"What is GitLab’s approach to SBOMs?",[13,381,382],{},"GitLab focuses on dynamic SBOMs that are:",[325,384,385,391,397,403],{},[328,386,387,390],{},[311,388,389],{},"Automatically generated",", so composition data stays current.",[328,392,393,396],{},[311,394,395],{},"Integrated"," with vulnerability scanning tools for risk assessment.",[328,398,399,402],{},[311,400,401],{},"Easy to manage",", with support for ingesting and merging SBOMs.",[328,404,405,408],{},[311,406,407],{},"Continuously analyzed",", offering ongoing scanning to surface newly published vulnerabilities.",[13,410,411],{},[311,412,413],{},"How can I start implementing SBOMs in my organization?",[13,415,416],{},"Organizations can get started with SBOMs by generating them automatically as part of your existing CI/CD pipelines rather than treating them as a separate, manual exercise. GitLab Ultimate enables organizations to natively generate SBOMs as part of the standard DevSecOps workflow, and scan for vulnerabilities within the dependencies they identify. To get started, pick a critical application, produce an SBOM, and use it to determine which open-source components are in your builds and which vulnerabilities they contain. Generate an SBOM on every build so your inventory stays current, and feed the results into your vulnerability management and policy workflows so you can quickly trace a newly disclosed CVE to affected releases. Run this way, SBOMs meet emerging compliance and regulatory requirements, improve your security posture, and tighten your development practices.",{"title":418,"searchDepth":419,"depth":419,"links":420},"",2,[421,422,426,433,434,435],{"id":32,"depth":419,"text":33},{"id":54,"depth":419,"text":55,"children":423},[424],{"id":74,"depth":425,"text":75},3,{"id":113,"depth":419,"text":114,"children":427},[428,429,430,431,432],{"id":127,"depth":425,"text":128},{"id":154,"depth":425,"text":155},{"id":161,"depth":425,"text":162},{"id":210,"depth":425,"text":211},{"id":223,"depth":425,"text":224},{"id":278,"depth":419,"text":279},{"id":285,"depth":419,"text":286},{"id":306,"depth":419,"text":307},"security","2022-10-25","Learn what a software bill of materials is and why it has become essential to protect your software supply chain.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1756989645/fojzxakmfdea6jfqjkrl.png",{},true,"/en-us/blog/the-ultimate-guide-to-sboms",{"title":5,"description":438,"ogTitle":5,"ogDescription":438,"noIndex":441,"ogImage":442,"ogUrl":447,"ogSiteName":448,"ogType":449,"canonicalUrls":447},"https://about.gitlab.com/blog/the-ultimate-guide-to-sboms","https://about.gitlab.com","article","the-ultimate-guide-to-sboms","en-us/blog/the-ultimate-guide-to-sboms",[436,453,454,455,456],"DevSecOps","performance","open source","public sector","BlogPost","2026-06-25","GABCLosz5Er41LU7bbOlhGQfkzjjXxihyrGyGK8IruY",{"logo":461,"freeTrial":466,"sales":471,"login":476,"items":481,"search":807,"minimal":838,"duo":857,"switchNav":866,"pricingDeployment":877},{"config":462},{"href":463,"dataGaName":464,"dataGaLocation":465},"/","gitlab logo","header",{"text":467,"config":468},"Get free trial",{"href":469,"dataGaName":470,"dataGaLocation":465},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":472,"config":473},"Request a demo",{"href":474,"dataGaName":475,"dataGaLocation":465},"/sales/?contact-topic=request-demo","sales",{"text":477,"config":478},"Sign in",{"href":479,"dataGaName":480,"dataGaLocation":465},"https://gitlab.com/users/sign_in/","sign in",[482,511,610,615,729,785],{"text":483,"config":484,"menu":486},"Platform",{"dataNavLevelOne":485},"platform",{"type":487,"columns":488},"cards",[489,495,503],{"title":483,"description":490,"link":491},"The intelligent orchestration platform for DevSecOps",{"text":492,"config":493},"Explore our Platform",{"href":494,"dataGaName":485,"dataGaLocation":465},"/platform/",{"title":496,"description":497,"link":498},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":499,"config":500},"Meet GitLab Duo",{"href":501,"dataGaName":502,"dataGaLocation":465},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":504,"description":505,"link":506},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":507,"config":508},"Learn more",{"href":509,"dataGaName":510,"dataGaLocation":465},"/why-gitlab/","why gitlab",{"text":512,"left":444,"config":513,"menu":515},"Product",{"dataNavLevelOne":514},"solutions",{"type":516,"link":517,"columns":521,"feature":590},"lists",{"text":518,"config":519},"View all Solutions",{"href":520,"dataGaName":514,"dataGaLocation":465},"/solutions/",[522,546,569],{"title":523,"description":524,"link":525,"items":530},"Automation","CI/CD and automation to accelerate deployment",{"config":526},{"icon":527,"href":528,"dataGaName":529,"dataGaLocation":465},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[531,535,538,542],{"text":532,"config":533},"CI/CD",{"href":534,"dataGaLocation":465,"dataGaName":532},"/solutions/continuous-integration/",{"text":496,"config":536},{"href":501,"dataGaLocation":465,"dataGaName":537},"gitlab duo agent platform - product menu",{"text":539,"config":540},"Source Code Management",{"href":541,"dataGaLocation":465,"dataGaName":539},"/solutions/source-code-management/",{"text":543,"config":544},"Automated Software Delivery",{"href":528,"dataGaLocation":465,"dataGaName":545},"Automated software delivery",{"title":547,"description":548,"link":549,"items":554},"Security","Deliver code faster without compromising security",{"config":550},{"href":551,"dataGaName":552,"dataGaLocation":465,"icon":553},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[555,559,564],{"text":556,"config":557},"Application Security Testing",{"href":551,"dataGaName":558,"dataGaLocation":465},"Application security testing",{"text":560,"config":561},"Software Supply Chain Security",{"href":562,"dataGaLocation":465,"dataGaName":563},"/solutions/supply-chain/","Software supply chain security",{"text":565,"config":566},"Software Compliance",{"href":567,"dataGaName":568,"dataGaLocation":465},"/solutions/software-compliance/","software compliance",{"title":570,"link":571,"items":576},"Measurement",{"config":572},{"icon":573,"href":574,"dataGaName":575,"dataGaLocation":465},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[577,581,585],{"text":578,"config":579},"Visibility & Measurement",{"href":574,"dataGaLocation":465,"dataGaName":580},"Visibility and Measurement",{"text":582,"config":583},"Value Stream Management",{"href":584,"dataGaLocation":465,"dataGaName":582},"/solutions/value-stream-management/",{"text":586,"config":587},"Analytics & Insights",{"href":588,"dataGaLocation":465,"dataGaName":589},"/solutions/analytics-and-insights/","Analytics and insights",{"title":591,"type":516,"items":592},"GitLab for",[593,599,605],{"text":594,"config":595},"Enterprise",{"icon":596,"href":597,"dataGaLocation":465,"dataGaName":598},"Building","/enterprise/","enterprise",{"text":600,"config":601},"Small Business",{"icon":602,"href":603,"dataGaLocation":465,"dataGaName":604},"Work","/small-business/","small business",{"text":606,"config":607},"Public Sector",{"icon":608,"href":609,"dataGaLocation":465,"dataGaName":456},"Organization","/solutions/public-sector/",{"text":611,"config":612},"Pricing",{"href":613,"dataGaName":614,"dataGaLocation":465,"dataNavLevelOne":614},"/pricing/","pricing",{"text":616,"config":617,"menu":619},"Resources",{"dataNavLevelOne":618},"resources",{"type":516,"link":620,"columns":624,"feature":718},{"text":621,"config":622},"View all resources",{"href":623,"dataGaName":618,"dataGaLocation":465},"/resources/",[625,658,685],{"title":626,"items":627},"Getting started",[628,633,638,643,648,653],{"text":629,"config":630},"Install",{"href":631,"dataGaName":632,"dataGaLocation":465},"/install/","install",{"text":634,"config":635},"Quick start guides",{"href":636,"dataGaName":637,"dataGaLocation":465},"/get-started/","quick setup checklists",{"text":639,"config":640},"Learn",{"href":641,"dataGaLocation":465,"dataGaName":642},"https://university.gitlab.com/","learn",{"text":644,"config":645},"Product documentation",{"href":646,"dataGaName":647,"dataGaLocation":465},"https://docs.gitlab.com/","product documentation",{"text":649,"config":650},"Best practice videos",{"href":651,"dataGaName":652,"dataGaLocation":465},"/getting-started-videos/","best practice videos",{"text":654,"config":655},"Integrations",{"href":656,"dataGaName":657,"dataGaLocation":465},"/integrations/","integrations",{"title":659,"items":660},"Discover",[661,666,671,676,680],{"text":662,"config":663},"Customer success stories",{"href":664,"dataGaName":665,"dataGaLocation":465},"/customers/","customer success stories",{"text":667,"config":668},"Blog",{"href":669,"dataGaName":670,"dataGaLocation":465},"/blog/","blog",{"text":672,"config":673},"Demo Hub",{"href":674,"dataGaName":675,"dataGaLocation":465},"/demo-hub/","demo hub",{"text":677,"config":678},"The Source",{"href":679,"dataGaName":670,"dataGaLocation":465},"/the-source/",{"text":681,"config":682},"Remote",{"href":683,"dataGaName":684,"dataGaLocation":465},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":686,"items":687},"Connect",[688,693,698,703,708,713],{"text":689,"config":690},"GitLab Services",{"href":691,"dataGaName":692,"dataGaLocation":465},"/services/","services",{"text":694,"config":695},"Contribute",{"href":696,"dataGaName":697,"dataGaLocation":465},"https://contributors.gitlab.com","contribute",{"text":699,"config":700},"Community",{"href":701,"dataGaName":702,"dataGaLocation":465},"/community/","community",{"text":704,"config":705},"Forum",{"href":706,"dataGaName":707,"dataGaLocation":465},"https://forum.gitlab.com/","forum",{"text":709,"config":710},"Events",{"href":711,"dataGaName":712,"dataGaLocation":465},"/events/","events",{"text":714,"config":715},"Partners",{"href":716,"dataGaName":717,"dataGaLocation":465},"/partners/","partners",{"config":719,"title":722,"text":723,"link":724},{"background":720,"textColor":721},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":725,"config":726},"Read the latest",{"href":727,"dataGaName":728,"dataGaLocation":465},"/whats-new/","whats new",{"text":730,"config":731,"menu":733},"Company",{"dataNavLevelOne":732},"company",{"type":516,"columns":734},[735],{"items":736},[737,742,748,750,755,760,765,770,775,780],{"text":738,"config":739},"About",{"href":740,"dataGaName":741,"dataGaLocation":465},"/company/","about",{"text":743,"config":744,"footerGa":747},"Jobs",{"href":745,"dataGaName":746,"dataGaLocation":465},"/jobs/","jobs",{"dataGaName":746},{"text":709,"config":749},{"href":711,"dataGaName":712,"dataGaLocation":465},{"text":751,"config":752},"Leadership",{"href":753,"dataGaName":754,"dataGaLocation":465},"/company/team/e-group/","leadership",{"text":756,"config":757},"Handbook",{"href":758,"dataGaName":759,"dataGaLocation":465},"https://handbook.gitlab.com/","handbook",{"text":761,"config":762},"Investor relations",{"href":763,"dataGaName":764,"dataGaLocation":465},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":766,"config":767},"Trust Center",{"href":768,"dataGaName":769,"dataGaLocation":465},"/security/","trust center",{"text":771,"config":772},"AI Transparency Center",{"href":773,"dataGaName":774,"dataGaLocation":465},"/ai-transparency-center/","ai transparency center",{"text":776,"config":777},"Newsletter",{"href":778,"dataGaName":779,"dataGaLocation":465},"/company/contact/#contact-forms","newsletter",{"text":781,"config":782},"Press",{"href":783,"dataGaName":784,"dataGaLocation":465},"/press/","press",{"text":786,"config":787,"menu":788},"Contact us",{"dataNavLevelOne":732},{"type":516,"columns":789},[790],{"items":791},[792,797,802],{"text":793,"config":794},"Talk to sales",{"href":795,"dataGaName":796,"dataGaLocation":465},"/sales/","talk to sales",{"text":798,"config":799},"Support portal",{"href":800,"dataGaName":801,"dataGaLocation":465},"https://support.gitlab.com/hc/en-us","support portal",{"text":803,"config":804},"Customer portal",{"href":805,"dataGaName":806,"dataGaLocation":465},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":808,"login":809,"suggestions":816},"Close",{"text":810,"link":811},"To search repositories and projects, login to",{"text":812,"config":813},"gitlab.com",{"href":479,"dataGaName":814,"dataGaLocation":815},"search login","search",{"text":817,"default":818},"Suggestions",[819,821,825,827,831,835],{"text":496,"config":820},{"href":501,"dataGaName":496,"dataGaLocation":815},{"text":822,"config":823},"Code Suggestions (AI)",{"href":824,"dataGaName":822,"dataGaLocation":815},"/solutions/code-suggestions/",{"text":532,"config":826},{"href":534,"dataGaName":532,"dataGaLocation":815},{"text":828,"config":829},"GitLab on AWS",{"href":830,"dataGaName":828,"dataGaLocation":815},"/partners/technology-partners/aws/",{"text":832,"config":833},"GitLab on Google Cloud",{"href":834,"dataGaName":832,"dataGaLocation":815},"/partners/technology-partners/google-cloud-platform/",{"text":836,"config":837},"Why GitLab?",{"href":509,"dataGaName":836,"dataGaLocation":815},{"freeTrial":839,"mobileIcon":844,"desktopIcon":849,"secondaryButton":852},{"text":840,"config":841},"Start free trial",{"href":842,"dataGaName":470,"dataGaLocation":843},"https://gitlab.com/-/trials/new/","nav",{"altText":845,"config":846},"Gitlab Icon",{"src":847,"dataGaName":848,"dataGaLocation":843},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":845,"config":850},{"src":851,"dataGaName":848,"dataGaLocation":843},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":853,"config":854},"Get Started",{"href":855,"dataGaName":856,"dataGaLocation":843},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":858,"mobileIcon":862,"desktopIcon":864},{"text":859,"config":860},"Learn more about GitLab Duo",{"href":501,"dataGaName":861,"dataGaLocation":843},"gitlab duo",{"altText":845,"config":863},{"src":847,"dataGaName":848,"dataGaLocation":843},{"altText":845,"config":865},{"src":851,"dataGaName":848,"dataGaLocation":843},{"button":867,"mobileIcon":872,"desktopIcon":874},{"text":868,"config":869},"/switch",{"href":870,"dataGaName":871,"dataGaLocation":843},"#contact","switch",{"altText":845,"config":873},{"src":847,"dataGaName":848,"dataGaLocation":843},{"altText":845,"config":875},{"src":876,"dataGaName":848,"dataGaLocation":843},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":878,"mobileIcon":883,"desktopIcon":885},{"text":879,"config":880},"Back to pricing",{"href":613,"dataGaName":881,"dataGaLocation":843,"icon":882},"back to pricing","GoBack",{"altText":845,"config":884},{"src":847,"dataGaName":848,"dataGaLocation":843},{"altText":845,"config":886},{"src":851,"dataGaName":848,"dataGaLocation":843},{"title":888,"titleMobile":889,"button":890,"config":895},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":507,"config":891},{"href":892,"dataGaName":893,"dataGaLocation":894},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":896,"disabled":441},"release",{"data":898},{"text":899,"source":900,"edit":906,"contribute":911,"config":916,"items":921,"minimal":1130},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":901,"config":902},"View page source",{"href":903,"dataGaName":904,"dataGaLocation":905},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":907,"config":908},"Edit this page",{"href":909,"dataGaName":910,"dataGaLocation":905},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":912,"config":913},"Please contribute",{"href":914,"dataGaName":915,"dataGaLocation":905},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":917,"facebook":918,"youtube":919,"linkedin":920},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[922,969,1022,1066,1098],{"title":611,"links":923,"subMenu":938},[924,928,933],{"text":925,"config":926},"View plans",{"href":613,"dataGaName":927,"dataGaLocation":905},"view plans",{"text":929,"config":930},"Why Premium?",{"href":931,"dataGaName":932,"dataGaLocation":905},"/pricing/premium/","why premium",{"text":934,"config":935},"Why Ultimate?",{"href":936,"dataGaName":937,"dataGaLocation":905},"/pricing/ultimate/","why ultimate",[939],{"title":940,"links":941},"Contact Us",[942,945,947,949,954,959,964],{"text":943,"config":944},"Contact sales",{"href":795,"dataGaName":475,"dataGaLocation":905},{"text":798,"config":946},{"href":800,"dataGaName":801,"dataGaLocation":905},{"text":803,"config":948},{"href":805,"dataGaName":806,"dataGaLocation":905},{"text":950,"config":951},"Status",{"href":952,"dataGaName":953,"dataGaLocation":905},"https://status.gitlab.com/","status",{"text":955,"config":956},"Terms of use",{"href":957,"dataGaName":958,"dataGaLocation":905},"/terms/","terms of use",{"text":960,"config":961},"Privacy statement",{"href":962,"dataGaName":963,"dataGaLocation":905},"/privacy/","privacy statement",{"text":965,"config":966},"Cookie preferences",{"dataGaName":967,"dataGaLocation":905,"id":968,"isOneTrustButton":444},"cookie preferences","ot-sdk-btn",{"title":512,"links":970,"subMenu":979},[971,975],{"text":972,"config":973},"DevSecOps platform",{"href":494,"dataGaName":974,"dataGaLocation":905},"devsecops platform",{"text":976,"config":977},"AI-Assisted Development",{"href":501,"dataGaName":978,"dataGaLocation":905},"ai-assisted development",[980],{"title":981,"links":982},"Topics",[983,988,993,998,1003,1007,1012,1017],{"text":984,"config":985},"CICD",{"href":986,"dataGaName":987,"dataGaLocation":905},"/topics/ci-cd/","cicd",{"text":989,"config":990},"GitOps",{"href":991,"dataGaName":992,"dataGaLocation":905},"/topics/gitops/","gitops",{"text":994,"config":995},"DevOps",{"href":996,"dataGaName":997,"dataGaLocation":905},"/topics/devops/","devops",{"text":999,"config":1000},"Version Control",{"href":1001,"dataGaName":1002,"dataGaLocation":905},"/topics/version-control/","version control",{"text":453,"config":1004},{"href":1005,"dataGaName":1006,"dataGaLocation":905},"/topics/devsecops/","devsecops",{"text":1008,"config":1009},"Cloud Native",{"href":1010,"dataGaName":1011,"dataGaLocation":905},"/topics/cloud-native/","cloud native",{"text":1013,"config":1014},"AI for Coding",{"href":1015,"dataGaName":1016,"dataGaLocation":905},"/topics/devops/ai-for-coding/","ai for coding",{"text":1018,"config":1019},"Agentic AI",{"href":1020,"dataGaName":1021,"dataGaLocation":905},"/topics/agentic-ai/","agentic ai",{"title":1023,"links":1024},"Solutions",[1025,1027,1029,1034,1038,1041,1045,1048,1050,1053,1056,1061],{"text":556,"config":1026},{"href":551,"dataGaName":556,"dataGaLocation":905},{"text":545,"config":1028},{"href":528,"dataGaName":529,"dataGaLocation":905},{"text":1030,"config":1031},"Agile development",{"href":1032,"dataGaName":1033,"dataGaLocation":905},"/solutions/agile-delivery/","agile delivery",{"text":1035,"config":1036},"SCM",{"href":541,"dataGaName":1037,"dataGaLocation":905},"source code management",{"text":984,"config":1039},{"href":534,"dataGaName":1040,"dataGaLocation":905},"continuous integration & delivery",{"text":1042,"config":1043},"Value stream management",{"href":584,"dataGaName":1044,"dataGaLocation":905},"value stream management",{"text":989,"config":1046},{"href":1047,"dataGaName":992,"dataGaLocation":905},"/solutions/gitops/",{"text":594,"config":1049},{"href":597,"dataGaName":598,"dataGaLocation":905},{"text":1051,"config":1052},"Small business",{"href":603,"dataGaName":604,"dataGaLocation":905},{"text":1054,"config":1055},"Public sector",{"href":609,"dataGaName":456,"dataGaLocation":905},{"text":1057,"config":1058},"Education",{"href":1059,"dataGaName":1060,"dataGaLocation":905},"/solutions/education/","education",{"text":1062,"config":1063},"Financial services",{"href":1064,"dataGaName":1065,"dataGaLocation":905},"/solutions/finance/","financial services",{"title":616,"links":1067},[1068,1070,1072,1074,1077,1079,1082,1084,1086,1088,1090,1092,1094,1096],{"text":629,"config":1069},{"href":631,"dataGaName":632,"dataGaLocation":905},{"text":634,"config":1071},{"href":636,"dataGaName":637,"dataGaLocation":905},{"text":639,"config":1073},{"href":641,"dataGaName":642,"dataGaLocation":905},{"text":644,"config":1075},{"href":646,"dataGaName":1076,"dataGaLocation":905},"docs",{"text":667,"config":1078},{"href":669,"dataGaName":670,"dataGaLocation":905},{"text":1080,"config":1081},"What's new",{"href":727,"dataGaName":728,"dataGaLocation":905},{"text":662,"config":1083},{"href":664,"dataGaName":665,"dataGaLocation":905},{"text":681,"config":1085},{"href":683,"dataGaName":684,"dataGaLocation":905},{"text":689,"config":1087},{"href":691,"dataGaName":692,"dataGaLocation":905},{"text":694,"config":1089},{"href":696,"dataGaName":697,"dataGaLocation":905},{"text":699,"config":1091},{"href":701,"dataGaName":702,"dataGaLocation":905},{"text":704,"config":1093},{"href":706,"dataGaName":707,"dataGaLocation":905},{"text":709,"config":1095},{"href":711,"dataGaName":712,"dataGaLocation":905},{"text":714,"config":1097},{"href":716,"dataGaName":717,"dataGaLocation":905},{"title":730,"links":1099},[1100,1102,1104,1106,1108,1110,1114,1119,1121,1123,1125],{"text":738,"config":1101},{"href":740,"dataGaName":732,"dataGaLocation":905},{"text":743,"config":1103},{"href":745,"dataGaName":746,"dataGaLocation":905},{"text":751,"config":1105},{"href":753,"dataGaName":754,"dataGaLocation":905},{"text":756,"config":1107},{"href":758,"dataGaName":759,"dataGaLocation":905},{"text":761,"config":1109},{"href":763,"dataGaName":764,"dataGaLocation":905},{"text":1111,"config":1112},"Sustainability",{"href":1113,"dataGaName":1111,"dataGaLocation":905},"/sustainability/",{"text":1115,"config":1116},"Diversity, inclusion and belonging (DIB)",{"href":1117,"dataGaName":1118,"dataGaLocation":905},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":766,"config":1120},{"href":768,"dataGaName":769,"dataGaLocation":905},{"text":776,"config":1122},{"href":778,"dataGaName":779,"dataGaLocation":905},{"text":781,"config":1124},{"href":783,"dataGaName":784,"dataGaLocation":905},{"text":1126,"config":1127},"Modern Slavery Transparency Statement",{"href":1128,"dataGaName":1129,"dataGaLocation":905},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1131},[1132,1135,1138],{"text":1133,"config":1134},"Terms",{"href":957,"dataGaName":958,"dataGaLocation":905},{"text":1136,"config":1137},"Cookies",{"dataGaName":967,"dataGaLocation":905,"id":968,"isOneTrustButton":444},{"text":1139,"config":1140},"Privacy",{"href":962,"dataGaName":963,"dataGaLocation":905},[1142,1156],{"id":1143,"title":7,"body":440,"config":1144,"content":1146,"description":440,"extension":1150,"meta":1151,"navigation":444,"path":1152,"seo":1153,"stem":1154,"__hash__":1155},"blogAuthors/en-us/blog/authors/joel-krooswyk.yml",{"template":1145},"BlogAuthor",{"name":7,"config":1147},{"headshot":1148,"ctfId":1149},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749669392/Blog/Author%20Headshots/jkrooswyk-headshot.jpg","jkrooswyk","yml",{},"/en-us/blog/authors/joel-krooswyk",{},"en-us/blog/authors/joel-krooswyk","Vmt-OcBuIzNaY03V97x_r44OqM7iwUNmcaE4pqTlZAg",{"id":1157,"title":8,"body":440,"config":1158,"content":1159,"description":440,"extension":1150,"meta":1163,"navigation":444,"path":1164,"seo":1165,"stem":1166,"__hash__":1167},"blogAuthors/en-us/blog/authors/elisabeth-burrows.yml",{"template":1145},{"name":8,"config":1160},{"headshot":1161,"ctfId":1162},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659535/Blog/Author%20Headshots/liz_burrows_headshot.png","6Nj2Lio5W7HdeNYoysVgCf",{},"/en-us/blog/authors/elisabeth-burrows",{},"en-us/blog/authors/elisabeth-burrows","Aa3Md9daKifGCswl2xZz_ybV8wPpCajPpr3-IX9wRRg",[1169,1177,1185],{"title":1170,"description":1171,"heroImage":1172,"category":436,"date":1173,"authors":1174,"slug":1176,"externalUrl":440},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1175],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1178,"description":1179,"heroImage":1172,"category":436,"date":1180,"authors":1181,"slug":1184,"externalUrl":440},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1182,1183],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1186,"description":1187,"heroImage":1188,"category":436,"date":1189,"authors":1190,"slug":1192,"externalUrl":440},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1191],"Alisa Ho","claude-security-and-gitlab",{"promotions":1194},[1195,1209,1221,1232],{"id":1196,"categories":1197,"header":1199,"text":1200,"button":1201,"image":1206},"ai-modernization",[1198],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1202,"config":1203},"Get your AI maturity score",{"href":1204,"dataGaName":1205,"dataGaLocation":670},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1207},{"src":1208},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1210,"categories":1211,"header":1213,"text":1200,"button":1214,"image":1218},"devops-modernization",[1212,1006],"product","Are you just managing tools or shipping innovation?",{"text":1215,"config":1216},"Get your DevOps maturity score",{"href":1217,"dataGaName":1205,"dataGaLocation":670},"/assessments/devops-modernization-assessment/",{"config":1219},{"src":1220},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1222,"categories":1223,"header":1224,"text":1200,"button":1225,"image":1229},"security-modernization",[436],"Are you trading speed for security?",{"text":1226,"config":1227},"Get your security maturity score",{"href":1228,"dataGaName":1205,"dataGaLocation":670},"/assessments/security-modernization-assessment/",{"config":1230},{"src":1231},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1233,"paths":1234,"header":1237,"text":1238,"button":1239,"image":1244},"github-azure-migration",[1235,1236],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1240,"config":1241},"See how GitLab compares to GitHub",{"href":1242,"dataGaName":1243,"dataGaLocation":670},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1245},{"src":1220},{"header":1247,"blurb":1248,"button":1249,"secondaryButton":1254},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1250,"config":1251},"Get your free trial",{"href":1252,"dataGaName":470,"dataGaLocation":1253},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":943,"config":1255},{"href":795,"dataGaName":475,"dataGaLocation":1253},1786803775691]