### Problem to solve When a vulnerability is fixed "resolved" aka (removed from the default branch) in a user's project, there is no way of notifying them in the vulnerability list and within the vulnerability page. ### Intended users <!-- Who will use this feature? If known, include any of the following: types of users (e.g. Developer), personas, or specific company roles (e.g. Release Manager). It's okay to write "Unknown" and fill this field in later. * [Parker (Product Manager)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#parker-product-manager) * [Delaney (Development Team Lead)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#delaney-development-team-lead) * [Sasha (Software Developer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sasha-software-developer) * [Presley (Product Designer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#presley-product-designer) * [Devon (DevOps Engineer)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#devon-devops-engineer) * [Dana (Data Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#dana-data-analyst) Personas are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ --> * [Sidney (Systems Administrator)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sidney-systems-administrator) * [Sam (Security Analyst)](https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/#sam-security-analyst) ### Further details <!-- Include use cases, benefits, and/or goals (contributes to our vision?) --> We will need to provide some indication in the Vulnerability List UI that a vulnerability has been fixed/removed from the default branch. This presents a problem that as someone using the vulnerability list, I have no idea which vulnerabilities have been addressed and which ones are still pending mitigation. ### Proposal <!-- How are we going to solve the problem? Try to include the user journey! https://about.gitlab.com/handbook/journeys/#user-journey --> When the system no longer detects a finding that was associated with a vulnerability -in the default branch- , provide the user with some type of visual indication that this has happened. This can be in either or both of the vulnerability list and the vulnerability page. --- Summary from @andyvolpe in https://gitlab.com/gitlab-org/gitlab/-/issues/214656#note_339203830 > Vulnerabilities that have been fixed/removed will now be persisted. This is one of the new behaviors of Standalone vulnerabilities. Vulnerabilities in this state will be displayed with the 'Resolved' status IF they have been manually marked as resolved and have been removed/remediated. > IF vulnerabilities are removed/remediated by the user AND their state is NOT "Resolved" then they will receive a badge in the UI to make users aware that their state can be changed to resolve. This issue defines that experience. ### Design #### Vulnerabiltiy list updates See feature issue: https://gitlab.com/gitlab-org/gitlab/issues/35860#vulnerabiltiy-list-updates ##### Badge detail See feature issue: https://gitlab.com/gitlab-org/gitlab/issues/35860#badge-detail ### Permissions and Security <!-- What permissions are required to perform the described actions? Are they consistent with the existing permissions as documented for users, groups, and projects as appropriate? Is the proposed behavior consistent between the UI, API, and other access methods (e.g. email replies)?--> It should only be accessible if the vulnerability itself could be viewed. ### Documentation Update relevant screenshots of the product to show these messages properly. <!-- See the Feature Change Documentation Workflow https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html Add all known Documentation Requirements here, per https://docs.gitlab.com/ee/development/documentation/feature-change-workflow.html#documentation-requirements If this feature requires changing permissions, this document https://docs.gitlab.com/ee/user/permissions.html must be updated accordingly. --> ### Testing <!-- What risks does this change pose? How might it affect the quality of the product? What additional test coverage or changes to tests will be needed? Will it require cross-browser testing? See the test engineering process for further help: https://about.gitlab.com/handbook/engineering/quality/test-engineering/ --> Test for both the success & error case. Ensure that the error message is appropriate for all cases or is specific to the error itself. Ensure messaging throughout the experience is clear. <!-- ### What does success look like, and how can we measure that? --> <!-- Define both the success metrics and acceptance criteria. Note that success metrics indicate the desired business outcomes, while acceptance criteria indicate when the solution is working correctly. If there is no way to measure success, link to an issue that will implement a way to measure this. --> ### What is the type of buyer? <!-- Which leads to: in which enterprise tier should this feature go? See https://about.gitlab.com/handbook/product/pricing/#four-tiers --> ~"GitLab Ultimate" ### Links / references - [System notes to notify users instead](#5954) - [Standalone vulnerability](#13561) ### Implementation checklist - [ ] ~backend See https://gitlab.com/gitlab-org/gitlab/issues/35860 - [ ] Use current N+1 `resolved_on_default_branch` method in `ee/app/models/vulnerability.rb` as a short term solution. This result will be sent in the response to the UI. It's slow, but it will start giving us some correct data. - [ ] Extend GraphQL `VulnerabilityType` to return `resolved_on_default_branch` - [ ] Fix the existing issue described in #218012 to ensure the security scan ran in the latest pipeline before marking the vulnerability as resolved. - [ ] Create a `resolved_on_default_branch` column in the `vulnerabilities` table and set that value from the pipeline. We would probably need to default to `nil` to indicate the check has not been run yet. With this change, we would check the database value first, then calculate using the existing method. - [ ] Run a background migration to set the value as needed. - [ ] Remove the existing workaround method. - [ ] ~frontend Display notification when a vulnerability has all findings resolved but is still in a `detected` state