Key tool updates

This section highlights how major updates to the SHIP-HATS tool, implemented by service providers, impact users. It outlines the effects on existing users, required actions, and any important changes users should be aware of.

Deprecations

• GitLab upgraded to version 18.0 on 25 Jun’ 25, and with it, several features were deprecated or removed. These changes may affect how CI/CD job tokens work in your pipelines.

  Impact

  While this upgrade offers new features, it may also result in the removal of certain existing features.

  The following list highlights significant deprecations but is not exhaustive. For complete details, refer to GitLab Deprecations and removals by versions.

• Removal of Limit access from your project setting.

• Enforced use of Authorized groups and projects allowlist.

• Deprecation of Terraform CI/CD Templates

• Application Security Testing analyzers major version update

• Dependency Proxy token scope enforcement

  Action required

  1. Visit the GitLab Deprecations and removals by versions to review the features that will be impacted by the upgrade.
  2. Assess the workarounds and recommended actions provided by GitLab.
  3. Take the necessary actions to avoid any potential disruptions to your workflow.
  4. Ensure you upgrade to the latest versions of SHIP-HATS Templates and Compliance, as applicable, to stay aligned with the new features and changes.

March 2025

GitLab - Transition to SBOM-based dependency scanning

GitLab 17.9 introduces a new SBOM-based Dependency Scanning analyser Dependency-Scanning.latest.gitlab-ci.yml.

This transition aims to:

✅ Support more programming languages.
✅ Improve integration within the GitLab platform.
✅ Align with industry-standard SBOM reports for better security and compliance.

Gemnasium deprecation timelines

Gemnasium, GitLab’s existing dependency scanning tool, is being phased out:

🔹 Deprecation in GitLab 17.9: The current Dependency Scanning feature based on Gemnasium is deprecated.

🔹 End of support in GitLab 18.0: Gemnasium will no longer receive updates or support.

🔹 Available until GitLab 19.0: Although deprecated, it remains usable until this version.

📖 For more details, refer to:

• Dependency Scanning upgrades
• Dependency Scanning.

Default behaviour of GitLab 17.9

The (deprecated) Gemnasium analyser is used by default for all projects and files except the following cases:

For the above-mentioned cases, by default, the new Dependency Scanning analyser is used.

Disable new scanning analyser

To disable the new Dependency Scanning analyser for the above project and file types, set the CI/CD variable:

DS_EXCLUDED_ANALYZERS: dependency-scanning   Copy to clipboardErrorCopied

Enable new scanning analyser (Recommended)

Users are strongly encouraged to transition to the new SBOM-based scanner before these deadlines to maintain security and compatibility.

To enable the new Dependency Scanning analyser (Recommended), set the CI/CD variable:

DS_ENFORCE_NEW_ANALYZER: trueCopy to clipboardErrorCopied

Caution Setting both DS_EXCLUDED_ANALYZERS: dependency-scanning and DS_ENFORCE_NEW_ANALYZER: true may result in no dependency scanning being performed.