## Summary During the staging rollout of `dependency_management_auto_remediation`, an inconsistency was found between the **vulnerability report** and the **vulnerability details page**: - The **vulnerability report** (grey badge) displays the _first_ related MR from the finder — which may be an older, closed MR. - The **vulnerability details page** correctly displays the _most recent_ MR created for that vulnerability. This discrepancy is not intentional. The vulnerability report should match the vulnerability details page behavior and show the most recent related MR. ## Steps to reproduce 1. Enable the `dependency_management_auto_remediation` feature flag 2. Have a project with multiple auto-remediation MRs for the same vulnerability (including a closed one) 3. View the vulnerability report — the grey badge shows the first (possibly closed) MR 4. Open the vulnerability details — the correct (most recent) MR is shown ## Expected behavior The vulnerability report should show the most recent MR related to the vulnerability, consistent with the vulnerability details page. ## Current behavior The vulnerability report displays the first MR returned by the finder, which may be an older or closed MR. ## References - https://gitlab.com/gitlab-org/gitlab/-/work_items/595588#note_3340019306