### Problem to solve When a vulnerability is fixed "resolved" aka (removed from the default branch) in a user's project, there is no way of notifying them in the vulnerability list and within the vulnerability page. ### Intended users <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later. * [Parker (Product Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#parker-product-manager) * [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#delaney-development-team-lead) * [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer) * [Presley (Product Designer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#presley-product-designer) * [Devon (DevOps Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#devon-devops-engineer) * [Dana (Data Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#dana-data-analyst) Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ --> * [Sidney (Systems Administrator)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sidney-systems-administrator) * [Sam (Security Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sam-security-analyst) ### Further details <!-- Include use cases, benefits, and/or goals (contributes to our vision?) --> We will need to provide some indication in the UI of the standalone vulnerability page that a vulnerability has been fixed/removed from the default branch. This presents a problem that as someone using the vulnerability list, I have no idea which vulnerabilities have been addressed and which ones are still pending mitigation. ### Proposal <!-- How are we going to solve the problem? Try to include the user journey! https://about.gitlab.com/handbook/journeys/#user-journey --> When the system no longer detects a finding that was associated with a vulnerability -in the default branch- , provide the user with some type of visual indication that this has happened. This can be in either or both of the vulnerability list and the vulnerability page. ### Design #### Vulnerability page updates See feature issue: https://gitlab.com/gitlab-org/gitlab/issues/35860#vulnerability-page-updates #### Alert details See feature issue: https://gitlab.com/gitlab-org/gitlab/issues/35860#alert-details ### Permissions and Security <!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)?--> It should only be accessible if the vulnerability itself could be viewed. ### Documentation Update relevant screenshots of the product to show these messages properly. <!-- See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements If this feature requires changing permissions, this document https://docs.gitlab.com/ee/user/permissions.html must be updated accordingly. --> ### Testing <!-- What risks does this change pose? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? Will it require cross-browser testing? See the test engineering process for further help: https://about.gitlab.com/handbook/engineering/quality/test-engineering/ --> Test for both the success & error case. Ensure that the error message is appropriate for all cases or is specific to the error itself. Ensure messaging throughout the experience is clear. <!-- ### What does success look like, and how can we measure that? --> <!-- Define both the success metrics and acceptance criteria. Note that success metrics indicate the desired business outcomes, while acceptance criteria indicate when the solution is working correctly. If there is no way to measure success, link to an issue that will implement a way to measure this. --> ### What is the type of buyer? <!-- Which leads to: in which enterprise tier should this feature go? See https://about.gitlab.com/handbook/product/pricing/#four-tiers --> ~"GitLab Ultimate" ### Links / references - [System notes to notify users instead](#5954) - [Standalone vulnerability](#13561) ### Implementation checklist - [ ] ~backend See https://gitlab.com/gitlab-org/gitlab/issues/35860 - [ ] ~frontend Display notification when a vulnerability has all findings resolved but is still in a `detected` state