Support dependency graph visuals (#16815) · Epics · GitLab.org

Support dependency graph visuals

## Problem to solve AppSec teams face significant challenges in managing vulnerabilities within transitive dependencies, which are buried deep in complex dependency chains. When exploring a vulnerability within a package, understanding the dependency graph leading from the top-parent to the explored package is critical, as the only way to resolve that vulnerability is by upgrading the top-ancestor. Folll The goal of the dependency tree is to provide AppSec and engineers better understanding of the location of a package within a certain dependency graph to allow easier remediation ## Background * Today, the Dependency list do not show a dependency graph for a package, but rather the list of direct ancestors - more details [here](https://gitlab.com/gitlab-org/gitlab/-/issues/506259) * Transitioning this state to a state where for a specific package we have the full graph from top-ancestors down to the explored package requires constructing the data set - handled in this [issue](https://gitlab.com/gitlab-org/gitlab/-/issues/515297) ## Proposal ### **Phase 1** * A user will be able to view the dependency graphs for a specific vulnerability (the graph/s of the package in which the vulnerability is) or specific package. * Show Dependency graph for a package * In the **Project** and **Group** Dependency list, the user will be able to click on a link/button and a modal will show with the dependency graphs https://gitlab.com/gitlab-org/gitlab/-/issues/519625 * In the Vulnerability details, the user will view the dependency graph as part of the vulnerability details https://gitlab.com/gitlab-org/gitlab/-/issues/519625 * In the dependency API * In the vulnerability API * Is Transitive - yes/no indicator * In the Dependency list and in the vulnerability report, if the dependency is transitive there will be a badge/link/button that identify it ### **Phase 2 - Out of Scope for this epic** * Add a filter for both vulnerability report and dependency list if a package is transitive or not. ## Implementation Plan Technical implementation is driven by delivering the individual task towards each phase, topically. This ensures we are delivering the critical milestones Epic Workflow Board - https://gitlab.com/groups/gitlab-org/-/boards/5304291?epic_id=3486934 ### :white_check_mark: GraphQL endpoint for programmatic access | Type | Team | Issue | |------|------|-------| | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/520564+s | ### :construction: UI visualization | Type | Team | Issue | |------|------|-------| | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/520755+s | | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/520763+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/519967+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/519962+s | | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/520941+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/519965+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/524374+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/519964+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/520523+s | | ~"type::feature" | ~"Technical Writing" | https://gitlab.com/gitlab-org/gitlab/-/issues/520266+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/520269+s | | ~"type::maintenance" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/521406+s | ### :white_check_mark: Transitive data enrichment | Type | Team | Issue | |------|------|-------| | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/523223+s | | ~"type::feature" | ~frontend | https://gitlab.com/gitlab-org/gitlab/-/issues/523224+s | ### :construction: Pagination | Type | Team | Issue | | |------|------|-------|--| | ~"type::maintenance" | All | Determine feature flag and [multi-version compatibility](https://docs.gitlab.com/development/multi_version_compatibility/) strategy | %"18.2" | | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/530418+s | %"18.2" | | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/548933+s | %"18.2" | | ~"type::feature" | ~frontend | https://gitlab.com/groups/gitlab-org/-/epics/18221+s | %"18.2" | | ~"type::feature" | ~backend | https://gitlab.com/gitlab-org/gitlab/-/issues/548934+s | %"18.2" |  > [!important] > > This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.

epic