Security Insight 17.11 Planning Issue

Priority Features

Areas of focus	DRI	Delivery Scope for current milestone	Completion Milestone	Status (mid-milestone checkpoint)
Dependency list - Filter by specific version in... (&16431 - closed) Epic board	stage: implementation backend: @subashis frontend: @lorenzvanherwaarden	Add the ability to fetch versions with new Grap... (#521483 - closed) • Subashis Chakraborty • 18.0 (continuation from 17.10) Add the ability to filter dependencies by versi... (#513147 - closed) • Subashis Chakraborty • 17.11 • On track Add the ability to filter dependencies by versi... (#521496 - closed) • Subashis Chakraborty • 17.11 • On track Add the ability to filter dependencies based on... (#520585 - closed) • Subashis Chakraborty • 17.11 • On track Add querying for component versions (#521605 - closed) • Lorenz van Herwaarden • 17.11 • On track Add operators and translation logic to API in v... (#521607 - closed) • Lorenz van Herwaarden • 17.11 Add querying for component versions on group-level (#526125 - closed)	18.0	On Track (from Needs Attention last week) for 18.0 delivery Risk raised last week is mitigated. Committed scope remains intact. We are fixing the project level implementation and will document an edge case. Latest update &16431 (comment 2433979330)
Add `Reachable Library` to Vulnerability Report... (&16510 - closed) Epic board	stage: implementation frontend: @charlieeekroon backend: groupcomposition analysis dependency: groupcomposition analysis	[FE] Add "Reachable" to Vulnerability Report (#513995 - closed) • Zamir Martins, Charlie Kroon • 17.11 • On track [FE] Add "Reachable" To Vulnerability Details (#513989 - closed) • Zamir Martins, Charlie Kroon • 17.11 • On track	17.11	On Track - Dependency on groupcomposition analysis backend work Noted last week, an engineer on CA has volunteered to work on frontend, continuing MRs drafted in February. Our team is assisting with MR reviews. Latest update &15781 (comment 2431219412)
Support dependency graph visuals (&16815 - closed) Epic board	stage: implementation frontend: @sming-gitlab backend: Infrastructure dependency: groupsecurity infrastructure	[FE] Integrate with API data for vulnerability ... (#519967 - closed) • Samantha Ming • 17.11 • On track [FE] Integrate with API data for Project depend... (#519965 - closed) • Samantha Ming • 17.11 [FE] Integrate with API data for Group dependency (#524374 - closed) • Samantha Ming • 17.11 • Needs attention [Docs] Add dependency paths (#520266 - closed) • Ryan Lehmann • 17.11 • On track [FE] Add circular badge to dependency drawer (#520523 - closed) • Samantha Ming • 17.11 • On track [FE] Hide dependency_path_viewer (#521406 - closed) • Samantha Ming • 18.0 • On track	18.0	Frontend On Track for 18.0 delivery Dependency on groupsecurity infrastructure for backend. Latest update &16815 (comment 2426445798)
CycloneDX export for the project dependency list (#524733 - closed)	stage: refinement backend @bwill	CycloneDX export for the project dependency list (#524733 - closed) • Brian Williams • 17.11 • On track	17.11	On Track for 17.11 Feature is enabled globally on gitlab.com. RPI draft is available gitlab-com/www-gitlab-com!138876 (merged). Latest update #524733 (comment 2435388299)
Time-based Vulnerability Retention Limits (&16629 - closed)	stage: implementation frontend: @svedova backend: Infrastructure dependency: groupsecurity infrastructure	[Archive Export] Implement archive export UI (#515510 - closed) • Savas Vedova • 17.11 • On track [FE] Display empty state for vulnerability arch... (#524084 - closed) • Savas Vedova • 17.11 • On track	18.0	Frontend On Track for 18.0 delivery Dependency on groupsecurity infrastructure for backend Frontend work remaining is for UI notifications on report and details page. Latest update &16629 (comment 2421620276)
Security Dashboard Upgrade - New Charts and Fil... (&16517)	stage: UX and Framework Consultation frontend: @dpisek backend: Infrastructure dependency: groupsecurity infrastructure	https://gitlab.com/gitlab-com/security-risk-management-stage/-/issues/51+s	Q3	On Track for Q3 17.11 will be consultation for UX and Analytics Framework only. No implementation is planned.
https://gitlab.com/gitlab-org/gitlab/-/issues/454794+	stage: implementation backend: @uokeadu	https://gitlab.com/gitlab-org/gitlab/-/issues/454794+	17.11	On Track for 17.11 Frontend development is complete. Verification stage. Latest update https://gitlab.com/gitlab-org/gitlab/-/issues/454794#note_2430217668
Add PDF export of security reports (&16989 - closed) Epic dashboard	stage: POC review / implementation backend: @wandering_person	Build proof of concept for Project PDF export o... (#517980 - closed) • Michael Becker • 17.10 PDF base implementation (#524055 - closed) • Michael Becker • 18.0 • On track Legal review of Prawn licensing (#524059 - closed) • Michael Becker • 18.0 • On track	Q2	On Track for Q2 17.11 focus is the core PDF generator, and working with UX on final designs. Engineering capacity focus remains shifted to support a bug separate from this project. Latest update &16989 (comment 2436273698)
Migrate dependency filtering to GraphQL (#513524 - closed)	stage: refinement > implementation frontend: @dpisek backend: @dpisek	Migrate dependency filtering to GraphQL (#513524 - closed) • David Pisek • 17.11	TBD	Epics for project and group are defined with implementation issues created. Working to align backend capacity starting %18.0 Latest update #513524 (comment 2429040231)

Team member focuses

Name		Focus Areas	Capacity
@bwill	backend	CycloneDX export for the project dependency list (#524733 - closed)
@charlieeekroon	backend	Update Report Type tooltip to "Scanner: Full sc... (#523720 - closed) • Charlie Kroon • 17.11 • Needs attention Add `Reachable Library` to Vulnerability Report... (&16510 - closed)
@subashis	backend	Dependency list - Filter by specific version in... (&16431 - closed)	75%
@wandering_person	backend	Add PDF export of security reports (&16989 - closed) Investigate "Something went wrong" raised by VR (#497193 - closed)	75%
@uokeadu	backend	https://gitlab.com/gitlab-org/gitlab/-/issues/454794+ from 17.10 Database migration to correct vulnerabilities i... (#523433 - closed) workflowblocked
@dpisek	frontend	Security Dashboard Upgrade - New Charts and Fil... (&16517) consultation Migrate dependency filtering to GraphQL (#513524 - closed)
@lorenzvanherwaarden	frontend	Dependency list - Filter by specific version in... (&16431 - closed) Add related vulnerabilities container to issue ... (#519695 - closed)	70%
@svedova	frontend	Time-based Vulnerability Retention Limits (&16629 - closed) Disable identifier filter when group has more t... (#517915) Remove banner to Vuln Report re: Auto-resolve p... (#521038 - closed) https://gitlab.com/gitlab-com/security-risk-management-stage/-/issues/68+	75%
@sming-gitlab	frontend	Support dependency graph visuals (&16815 - closed)