Remove Admin Vulnerability from Developer role
Deprecation Summary
Beginning in %17.0 users with a Developer role will not be able to change the status of vulnerability. Users with a role of Maintainer and higher will continue to be able to change the status of a Vulnerability. As well as users belonging to a Custom Role with the Admin Vulnerability permission.
Related to:
Breaking Change
Users that require the ability to change the status of a vulnerability on the Vulnerability Report will need to belong to a Maintainer role or a Custom Role with the Admin Vulnerability
permission.
Affected Topology
This affects both Self-managed and SaaS users.
Affected Tier
- Ultimate
Checklists
Labels
-
This issue is labeled deprecation, and with the relevant ~devops::
,~group::
, and~Category:
labels. -
This issue is labeled breaking change if the removal of the deprecated item will be a breaking change.
Timeline
- As soon as possible, but no later than the third milestone preceding the major release (for example, given the following release schedule:
14.8, 14.9, 14.10, 15.0
–14.8
is the third milestone preceding the major release):-
A deprecation announcement entry has been created so the deprecation will appear in release posts and on the general deprecation page. -
Documentation has been updated to mark the feature as deprecated.
-
-
On or before the major milestone: A removal entry has been created so the removal will appear on the removals by milestones page and be announced in the release post. - On the major milestone:
-
The deprecated item has been removed. -
If the removal of the deprecated item is a breaking change, the merge request is labeled breaking change.
-
Mentions
-
Your stage's stable counterparts have been @mentioned
on this issue. For example, Customer Support, Customer Success (Technical Account Manager), Product Marketing Manager.- To see who the stable counterparts are for a product team visit product categories
- If there is no stable counterpart listed for Sales/CS please mention
@timtams
- If there is no stable counterpart listed for Support please mention
@gitlab-com/support/managers
- If there is no stable counterpart listed for Marketing please mention
@cfoster3
- If there is no stable counterpart listed for Sales/CS please mention
- Customer Support: @gerardo,
- Customer Success: @calebcooper, @mbrandner1, @yhsueh,
- Product Marketing Manager: @BrianMason
- To see who the stable counterparts are for a product team visit product categories
-
Your GPM has been @mentioned
so that they are aware of planned deprecations. The goal is to have reviews happen at least two releases before the final removal of the feature or introduction of a breaking change.
Deprecation Milestone
Planned Removal Milestone
Links
Relevant merge requests:
- Remove the `admin_vulnerability` ability from t... (!134579 - merged) • mo khan • 16.6
- Remove push_code check on Mutation.securityFind... (!135294 - merged) • mo khan • 16.6
- Bind vulnerability_feedback* to custom role per... (!136121 - merged) • mo khan • 16.7
- Enable disable_developer_access_to_admin_vulner... (!137567 - merged) • mo khan • 17.0
Edited by mo khan