Document malicious package advisory synchronization (Beta)

Bala Kumarrequested to merge
docs-malicious-package-advisories into master

What does this MR do and why?

Add a short "Malicious package advisories" section to the GitLab advisory database page. It states that GitLab maintains malicious package advisories and synchronizes them to the instance, with the availability details (Ultimate; GitLab.com, GitLab Self-Managed, GitLab Dedicated; Beta).

This documents the availability introduced by enabling the malware advisory sync by default in !249740 (merged), which makes it available for all Ultimate instances from GitLab 19.3.

Scope

This MR focuses on the GitLab 19.3 offerings only: GitLab.com, GitLab Self-Managed, and GitLab Dedicated, all on GitLab Ultimate. Offline environments are out of scope here. The section documents that offline environments are not yet supported, and offline support is proposed in #594758.

Beyond 19.3: GitLab Premium instances will also get the GLAM sync in GitLab 19.4 when they purchase the Dependency Firewall add-on, tracked in #606640. That expansion is not part of this MR, so the documented availability stays at Ultimate for now.

Notes for reviewers

  • The section notes that the dependency firewall uses these advisories to block malicious packages. The dependency firewall is still in progress (#606640) and has no dedicated documentation page yet, so that reference is intentionally left unlinked for now.
  • The section includes a history block naming the sync_malware_advisories and ingest_malware_advisories flags and their enabled-by-default state. This should land together with, or after, the default-enable MR above.
  • Draft pending technical-writer review.

Related

Edited by Bala Kumar

Merge request reports