VulnerabilitiesOverTime chart does not display all vulnerabilities

The VulnerabilitiesOverTime panel on the Security Dashboard is showing incorrect data after a new vulnerability is added. Specifically, only the new vulnerability appears at the latest timestamp. All previously existing vulnerabilities disappear from that point in time. In this issue we want to investigate why this is happening.

• Related discussion: !199001 (comment 2659368516)
• Example project to import in gdk: https://gitlab.com/gitlab-examples/security/security-reports/
• Example project with FF enabled on production: https://gitlab.com/groups/gitlab-org/govern/threat-insights-demos/verification-projects/security-dashboard-new/-/security/dashboard

Images

GraphQL Query

{
  group(fullPath: "gitlab-org") {
    id
    securityMetrics {
      vulnerabilitiesOverTime(
        startDate: "2025-04-20T00:00:00Z"
        endDate: "2025-07-01T00:00:00Z"
      ) {
        nodes {
          date
          bySeverity {
            severity
            count
          }
        }
      }
    }
  }
}

There are more queries to try out here: !198101 (merged)