Known vulnerabilities in third-party components or dependencies are very common. They could even be part of the OWASP Top 10 List of Using Components with Known Vulnerabilities. The OWASP Web Malware Scanner (see https://www.owasp.org) is a malware scanner for web applications. It can be used to scan a web application by using signatures from a community build and a managed database. It works by testing each file of the web application for known signatures of malware.
These known vulnerable components should be identified at an early development stage. It is also good practice to perform vulnerability scanning of the dependency components not only in the development stage but also in the production stage on a regular basis.
Again, the dependency scan in your GitLab workflow is controlled through the .gitlab-ci.yml file. It also uses the Docker-in-Docker technique...
