Blog post

Expanding GitLab's GraphQL Vulnerabilities API

Posted August 1, 2025 · 2 min read

Google Summer of Code 2025

Overview

Introduction:

GitLab's security features help developers find vulnerabilities in their code, but the current API doesn't expose all the important information that security teams need. For example, users can't easily access details about when vulnerabilities were first discovered, who authored the related commits, or which pipelines detected the issues. This makes it difficult for teams to automate their security workflows and track vulnerability trends over time.

Key Features:

Added Vulnerability ID in Vulnerability & Archival Report CSV File
Fixed bug where vulnerability returns none without license
Return vulnerabilities initial_detected_pipeline and latest_detected_pipeline in GraphQL API
GraphQL allows nested fields to be selected; this closed https://gitlab.com/gitlab-org/gitlab/-/issues/384476 as well!
Vulnerability bulk confirm mutation
Fix Style/SuperArguments offences
Added shortcut to check "viewed" on MR-changes

Contributions

Here’s a list of my MRs:

Open Source