diff --git a/doc/user/application_security/continuous_vulnerability_scanning/index.md b/doc/user/application_security/continuous_vulnerability_scanning/index.md index 0271bfc0de4f533cc4a83fc530cbeefa53543570..eefde1105375761a7cb8bea8626f633b44dc6470 100644 --- a/doc/user/application_security/continuous_vulnerability_scanning/index.md +++ b/doc/user/application_security/continuous_vulnerability_scanning/index.md @@ -22,9 +22,9 @@ Projects that depend on the affected components have new vulnerabilities automat Continuous Vulnerability Scanning detects vulnerabilities in the latest CycloneDX SBOM reports for the default branch. [Dependency Scanning](../dependency_scanning/index.md) and [Container Scanning](../container_scanning/index.md) are used to generate these reports. -## Supported component types +## Supported package types -Components with the following [PURL types](https://github.com/package-url/purl-spec/blob/346589846130317464b677bc4eab30bf5040183a/PURL-TYPES.rst) are supported: +Components with the following [package URL types](https://github.com/package-url/purl-spec/blob/346589846130317464b677bc4eab30bf5040183a/PURL-TYPES.rst) are supported: - `composer` - `conan` @@ -36,7 +36,10 @@ Components with the following [PURL types](https://github.com/package-url/purl-s - `nuget` - `pypi` -Work to support `apk` and `rpm` PURL types is tracked in [issue 428703](https://gitlab.com/gitlab-org/gitlab/-/issues/428703). +Work to support `apk` and `rpm` package URL types is tracked in [issue 428703](https://gitlab.com/gitlab-org/gitlab/-/issues/428703). + +Go pseudo versions are not supported. A project dependency that references a Go pseudo version is +never considered as affected because this might result in false negatives. ## Configuration @@ -51,13 +54,6 @@ For self-managed GitLab instances in an environment with limited, restricted, or some adjustments are required to successfully scan CycloneDX reports for vulnerabilities. For more information, see the offline [quick start guide](../../../topics/offline/quick_start_guide.md#enabling-the-package-metadata-database). -## Supported languages and package managers - -The supported files and versions are the ones supported by -[Dependency Scanning](../dependency_scanning/index.md#supported-languages-and-package-managers). - -Go pseudo versions are not supported. A project dependency that references a Go pseudo version is never considered as affected. This might result in false negatives. - ## Checking new vulnerabilities New vulnerabilities detected by Continuous Vulnerability Scanning are visible on the [Vulnerability Report](../vulnerability_report/index.md).