## Why The `fast_dependency_paths_enabled` project security setting has no effect after gitlab-org/gitlab!257733 merges. The setting selected a "fast" dependency graph build. A fast build recorded one path for each dependency instead of all possible paths, to use less memory and time on large graphs. gitlab-org/gitlab!257733 changes `Sbom::BuildDependencyGraph` so that every build records only the direct (parent to child) edges. `Sbom::PathFinder` then derives the full paths from these edges at read time. This work is part of #593156. Because every build is now the same, the setting does not change anything. But users can still set it through the REST API, the database still stores it, and an internal event still counts each time a project turns it on. This issue tracks the deprecation and the cleanup of these parts. Breaking change: no. Clients do not need to change anything. They can stop sending the parameter. ## Scope | Part | Location | State after !257733 | |------|----------|---------------------| | REST API parameter | `ee/lib/api/project_security_settings.rb`, `PUT /projects/:id/security_settings` | Accepted, and the value is written to the column. The description is `Deprecated. Has no effect; dependency graph builds always record direct edges only.` | | REST API response key | `GET` and `PUT /projects/:id/security_settings` | The endpoint presents the `ProjectSecuritySetting` record without an entity, so the response includes `fast_dependency_paths_enabled` with the stored value. | | Model | `ee/app/models/project_security_setting.rb` | `set_fast_dependency_paths!`, the `after_commit :track_fast_dependency_paths_change` callback, and `fast_dependency_paths_newly_enabled?`. | | Specs and factory | `ee/spec/requests/api/project_security_settings_spec.rb`, `ee/spec/models/project_security_setting_spec.rb`, `ee/spec/factories/project_security_settings.rb` | The specs assert that the value is written, returned and tracked. The factory sets the attribute. | | Database column | `project_security_settings.fast_dependency_paths_enabled` (`boolean`, `DEFAULT false NOT NULL`), added by `db/migrate/20260622143821_add_fast_dependency_paths_enabled_to_project_security_settings.rb` | Stored, but no behavior depends on it. | | Internal event | `ee/config/events/enabled_fast_dependency_paths.yml` | Fires when the setting changes from `false` to `true`. | | Metrics | `ee/config/metrics/counts_7d/count_distinct_project_id_from_enabled_fast_dependency_paths_7d.yml`, `ee/config/metrics/counts_28d/count_distinct_project_id_from_enabled_fast_dependency_paths_28d.yml` | Count projects that turn on a setting that does nothing. | | GraphQL | None | There is no GraphQL field or argument for this setting. | | User documentation | `doc/api/project_security_settings.md` | Does not document the parameter. Only the generated `doc/api/openapi/openapi_v3.yaml` describes it. | | Developer documentation | `doc/development/sec/sbom_dependency_graph_ingestion_overview.md` | Says that the table "is designed as a closure table", and refers readers to the `BuildDependencyGraph` class documentation, which no longer describes the table. | ## Rules that apply - REST API v4 must not have breaking changes, even in a major release. Removing a parameter or a response key is a breaking change. See `doc/development/api_styleguide.md#breaking-changes`. - For a removed feature, the style guide recommends silent degradation for settings endpoints such as this one. The endpoint continues to accept the argument as a no-op and continues to return the field with a sensible static value. See `doc/development/api_styleguide.md#what-to-do-with-feature-removals`. - Document the deprecation of an attribute with a history note and inline deprecation text. See `doc/development/documentation/restful_api_styleguide.md#deprecations`. - Remove a metric by setting `status: removed`, `removed_by_url` and `milestone_removed`. Do not delete the metric YAML. See `doc/development/internal_analytics/metrics/metrics_lifecycle.md#remove-a-metric`. - Remove an event by moving its definition to the `removed` subfolder and setting `status`, `milestone_removed` and `removed_by_url`. See `doc/development/internal_analytics/internal_event_instrumentation/event_lifecycle.md#remove-an-event`. ## Proposal 1. In the milestone that !257733 merges (19.6, which ends on 2026-11-13, or 19.7 if it merges later): - Add `fast_dependency_paths_enabled` to `doc/api/project_security_settings.md` as a deprecated attribute, with a history note that links to this issue. - Add an entry to `doc/api/rest/deprecations.md`. Say that there is no replacement and that no action is necessary. 2. In the next milestone: - Make `GET` and `PUT` return `fast_dependency_paths_enabled: false` as a static value. - Make the `PUT` endpoint accept `fast_dependency_paths_enabled` and ignore it. Do not write the column. - Update the request specs and the factory that assert the old behavior. - Remove `set_fast_dependency_paths!`, the `after_commit` callback and their specs. - Remove the `enabled_fast_dependency_paths` event and its 7d and 28d metrics with the lifecycle steps above. - Update `doc/development/sec/sbom_dependency_graph_ingestion_overview.md`. Say that `sbom_graph_paths` stores direct edges only, and that `Sbom::PathFinder` derives the full paths at read time. Replace the reference to the `BuildDependencyGraph` class documentation. 3. Database column (decide in this issue): - Option A: keep the column. It is one `boolean` with a default. The static value from step 2 keeps the response key. - Option B: remove the column with the three-release process in `doc/development/database/avoiding_downtime_in_migrations.md#dropping-columns`. Add `ignore_column` with `remove_with` and `remove_after` in milestone N, no earlier than step 2. Drop the column in a post-deployment migration in milestone N+1, and make its `down` add the column again with `default: false, null: false`. Remove the ignore rule in milestone N+2. The static value from step 2 keeps the response key. ## Removal milestone - REST API parameter and response key: no removal in REST API v4. They stay as a no-op parameter and a static value. - Internal event, metrics and model code: the milestone after !257733 merges (19.7 if !257733 merges in 19.6). - Database column: only with Option B, across three milestones that start no earlier than step 2.