18.2 AST::Static Analysis planning issue

• General info
• Priorities
  • Feature
  • Maintenance and bugs
  • Standalone issues
    • Bugs
      • P1
      • P2
      • P3
    • Other
      • Feature
      • Maintenance
• Engineering allocation

General info

• Period: 2025-06-14 to 2025-07-11
• Planning board
• Reaction rotation: @julianthome (primary), @jleasure (secondary).

Priorities

Feature

Our highest priority feature work this milestone is:

Priority	Initiative	Issues	DRI
1	SAST support for C and C++: experiment release (&17343 - closed)	- gitlab-advanced-sast-cpp: add to SAST CI/CD com... (#534737 - closed) • Hua Yan • 18.6 • Needs attention - https://gitlab.com/gitlab-org/gitlab/-/issues/534734+s	@jleasure
2	Duo Vulnerability Resolution: Add support for r... (&15716 - closed)	DRI is OOO	@adamcohen
4	Faster Advanced SAST: Diff-based scanning in MRs (&16790 - closed)	Support diff-based scanning in security-report-... (#540585 - closed) • Shao Ming Tan • 18.2 Support diff-based scanning in report module (#540584 - closed) • Shao Ming Tan • 18.2 Add tests for diff-based scanning in lightz (#540667 - closed) • Shao Ming Tan • 18.2 https://gitlab.com/gitlab-org/gitlab/-/issues/540580+s	@smtan

Maintenance and bugs

Our highest priority maintenance work this milestone is:

Priority	Initiative	Issues	DRI
1	https://gitlab.com/groups/gitlab-org/-/epics/17336+	- https://gitlab.com/gitlab-org/gitlab/-/issues/515842+ - https://gitlab.com/gitlab-org/gitlab/-/issues/533993+	@mtolpin
2	https://gitlab.com/groups/gitlab-org/-/epics/16530+	- https://gitlab.com/gitlab-org/gitlab/-/issues/545946+ - https://gitlab.com/gitlab-org/gitlab/-/issues/550171+	@philipcunningham

Standalone issues

Bugs

Bugs board (no vulnerabilities, no milestone).

Vulnerabilities are handled by the reaction rotation.

P1

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "group::static analysis" AND label = "priority::1" AND label = "type::bug" AND label != "vulnmapper"  AND milestone = "18.2"

P2

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "group::static analysis" AND label = "priority::2" AND label = "type::bug" AND label != "vulnmapper" AND milestone = "18.2"

P3

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "group::static analysis" AND label = "priority::3" AND label = "type::bug" AND label != "vulnmapper" AND milestone = "18.2"

Other

Feature

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "type::feature" AND label = "group::static analysis" AND milestone = "18.2"

Maintenance

---
display: table
fields: title, healthStatus, assignees
---
epic = none AND label = "type::maintenance" AND label = "group::static analysis" AND milestone = "18.2"

Engineering allocation

• everyone: work on one typebug before picking-up a new issue.
• @adamcohen: OOO.
• @hyan3: typemaintenance contributing to https://gitlab.com/groups/gitlab-org/-/epics/16530
• @jleasure: typemaintenance secondary rotation, typefeature DRI for &17343 (closed)
• @julianthome: typemaintenance primary rotation
• @mtolpin: typemaintenance DRI for https://gitlab.com/groups/gitlab-org/-/epics/17336, typemaintenance / typefeature contributing to other issues
• @philipcunningham: typemaintenance DRI for https://gitlab.com/groups/gitlab-org/-/epics/16530
• @smtan: typefeature DRI for &16790 (closed)