FAQ | This is a LIVE service | Changelog

Fix dependency scanning

We are missing dependency scanning checks of python packages from AutoDevOps on all Python apps.

The Dependency Scanning of AutoDevOps requires PIP_REQUIREMENTS_FILE to be set if your are not using a requirements.txt file. See https://docs.gitlab.com/ee/user/application_security/dependency_scanning/index.html#configuring-specific-analyzers-used-by-dependency-scanning

Most of our repos use requirements/XXX.txt files and a requirements.txt in the root that imports those via -r. -r is not supported by gemnasium, see http://docs.gemnasium.net/en/stable/languages/python.html