17.6 Secure:Composition Analysis Planning Issue

• General info
• Priorities
  • Feature
  • Maintenance and bugs
    • Epics
    • Standalone issues
      • Bugs
        • P1
        • P2
        • P3
      • Other
        • Feature
        • Maintenance
• Engineering allocation

General info

• Period: 2024-10-12 to 2024-11-15
• Planning board

• Reaction rotation: "@ifrenkel (primary), "@hacks4oats (secondary). Full schedule.

Priorities

Feature

Our Highest Priority feature work this milestone is:

Priority	Initiative	Issues	DRI
1	SBOM-based dependency scanning findings for non... (&14636 - closed)	TBC	@hacks4oats
2	Deprecate build support on Dependency Scanning ... (&14146)	TBC	@gonzoyumo
3	Efficient Dependency & Container Vulnerability ... (&11544 - closed)	TBC	@YashaRise
4	Full dependency graph support in new component ... (&7288 - closed)	Report vulnerable dependency paths for Bundler ... (#229812 - closed) Report vulnerable dependency paths for Composer... (#229814 - closed)	@hacks4oats
5	Efficient Dependency & Container Vulnerability ... (&11912)	TBC	@onaaman

Maintenance and bugs

Epics

Priority	Initiative	Issues	DRI
1	Further Package Metadata DB (License DB) Reliab... (&11228)	- https://gitlab.com/gitlab-org/gitlab/-/issues/429486+s - Establish and Implement Versioning Strategy for... (#469035) • Unassigned • Backlog • On track - Update all id columns to BIGINT in Package Meta... (#439299 - closed) • Philip Cunningham • 17.6 • On track	@philipcunningham
2	Improve Reliability for Operational Container S... (&14447)	Create test pipeline for the OCS test project (#474464) Extend gitlab-agent and trivy-k8s-wrapper to tr... (#474470)	@smtan

Standalone issues

Bugs

P1

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "group::composition analysis" AND label = "priority::1" AND label = "type::bug" AND label != "vulnmapper" AND opened = true AND milestone = "17.6"

P2

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "group::composition analysis" AND label = "priority::2" AND label = "type::bug" AND label != "vulnmapper" AND opened = true AND milestone = "17.6"

P3

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "group::composition analysis" AND label = "priority::3" AND label = "type::bug" AND label != "vulnmapper" AND opened = true AND milestone = "17.6"

Bugs board (no vulns)

Other

Feature

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "type::feature" AND label = "group::composition analysis" AND opened = true AND milestone = "17.6"

Maintenance

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "type::maintenance" AND label = "group::composition analysis" AND opened = true AND milestone = "17.6"

Engineering allocation

• everyone: typebug work on one bug before picking-up a new issue.
• @atiwari71: TBC
• @fcatteau: TBC
• @fernando-c: TBC
• @gonzoyumo: typefeature DRI for &14146
• @hacks4oats: typefeature DRI for &14636 (closed). typemaintenance Secondary Reaction Rotation.
• @ifrenkel: typemaintenance Primary Reaction Rotation.
• @mamos-gl: typemaintenance DRI for https://gitlab.com/groups/gitlab-org/-/epics/14923
• @nilieskou: OOO
• @onaaman: typefeature DRI for &11912.
• @philipcunningham: typemaintenance DRI for &11228.
• @smtan: typemaintenance DRI for &14447.
• @YashaRise: typefeature DRI for &11544 (closed).
• @zmartins: OOO

added gitlab-org#13208 as parent epic

changed milestone to %17.6

added devopssecure groupcomposition analysis sectionsec typeignore labels

changed the description

removed devopssecure label

added devopssecure label

removed devopssecure label

added devopssecure label

removed devopssecure label

added devopssecure label

Pre-planning notes

Add for planning breakdown (tentative DRI @fcatteau): Deprecate build support on Dependency Scanning ... (&14146)

mentioned in issue technical-writing#1137

@thiagocsf There has been some confusion over the Continuous Vulnerability Scanning feature. I certainly don't know the feature as well as I should do. Is that a suitable topic to address in %17.6? If so, I'll create an issue to define the scope of work.

Yes, @rdickenson. In particular, I think we should look at [meta] Feature name: Continuous Vulnerability S... (#477593).

On a related note, Fix Dependency Scanning workflow (!169197 - merged) is coming your way soon.

@rdickenson I'm happy to provide assistance on this if needed. I'm also eager to get [meta] Feature name: Continuous Vulnerability S... (#477593) addressed

changed the description

Bugs

• Google Storage Bucket Level Access Disabled (#482919 - closed) • Zamir Martins • 17.6

Deliverable

• https://gitlab.com/gitlab-org/gitlab/-/issues/429486+s
• Update all id columns to BIGINT in Package Meta... (#439299 - closed) • Philip Cunningham • 17.6 • On track
• Track "unknown" License Classification in GitLa... (#443515 - closed) • Philip Cunningham • 17.6

Stretch

• Establish and Implement Versioning Strategy for... (#469035) • Unassigned • Backlog • On track
• Run Package Metadata DB (License DB) schema mig... (#467647) • Unassigned • Backlog
• Add Integration tests for License Exporter in P... (#413637) • Unassigned • Backlog
• Implement Monitoring and Alerts for Package Met... (#427248) • Unassigned • Backlog

I've moved to groupstatic analysis and re-focusing my attention there for the rest of the milestone.

/cc @thiagocsf

GitLab Hackathon: October 21 - October 28

• Slack announcement (internal, 90 days): https://gitlab.slack.com/archives/C0259241C/p1729084240047889
• Hackathon page: https://about.gitlab.com/community/hackathon

Product teams: Please prepare issues with the quick win label (see new criteria-for-quick-win-issues)

Do we have any item to suggset for this hackathon that is not already labeled?

cc @johncrowley

typebug

• Fix Missing Export for 9.44.0.Final Packages in... (#491600) • Yasha Rise • 17.10 • On track

typefeature

• Deprecate build support on Dependency Scanning ... (&14146) • Olivier Gonzalez

changed the description

mentioned in issue gitlab-com/Product#13688 (closed)

changed the description

Deliverable

• Unify EPSS and KEV under CVE Enrichments: Updat... (#482874 - closed) • Orin Naaman • 17.6

• Extend advisory-processor for KEV (#478041 - closed) • Orin Naaman • 17.7

• Last batch of EPSS data is missing from the DB ... (#477778 - closed) • Orin Naaman • 17.6

• Add KEV to GitLab database (#480139 - closed) • Orin Naaman • 17.6

Stretch

• Enable KEV Querying via GraphQL API (#480140 - closed) • Orin Naaman • 17.7

typebug

• SemverDialects parse NPM version should have a ... (#472479 - closed) • Igor Frenkel • 17.8

Deliverable

• Report vulnerable dependency paths for npm (Nod... (#229813 - closed) • Igor Frenkel • 17.6

changed the description

Deliverable

Create test pipeline for the OCS test project (#474464)

Extend gitlab-agent and trivy-k8s-wrapper to tr... (#474470)

changed the description

FYI I've adjusted the milestone due date. The %17.6 release is planned for Nov 21st so the cut off will be on Nov 15th.

mentioned in epic gitlab-org/secure#2

closed