## Summary Advisory-driven Continuous Vulnerability Scanning (`PackageMetadata::GlobalAdvisoryScanWorker` -> `IngestCvsSliceService`) and pipeline security-report ingestion (`Security::StoreSecurityReportsByProjectWorker` -> `IngestReportSliceService`) run the same `Security::Ingestion` slice tasks and converge on the same `gitlab_sec` rows (`vulnerability_occurrences`, `vulnerabilities`, `vulnerability_statistics`, `vulnerability_identifiers`), keyed by identical finding UUIDs. When their transactions overlap they acquire row locks in inconsistent order and deadlock on the sec primary. This has been confirmed in production (see gitlab-org/gitlab#602806 for the full root-cause analysis and log evidence): a deadlock on `vulnerabilities` (2026-06-16) and another on `vulnerability_statistics` (2026-06-17), each with the CVS advisory worker as the victim and the pipeline ingestion worker holding the lock. ## Approach Extend the deadlock-prevention pattern already used in `IngestIdentifiers` (which sorts its bulk write by `[[REDACTED:learned] fingerprint]` with an explanatory comment) to every shared bulk-write task that targets a uniquely-keyed table. Each task sorts its rows by the key it actually locks, so all ingestion transactions acquire the row locks in a consistent order. This converts deadlock cycles into ordinary lock-waits. This is complementary to, not a replacement for, the database-health backpressure and CVS-scoping/activity-guardrail discussions happening in gitlab-org/gitlab#602806. Those reduce write volume and WAL; this removes the deadlock failures and their retry amplification. ## Delivery A series of small, single-table merge requests (one child issue each) so each change is easy to review, plus a guardrail to prevent regressions as this scales with VAC. ### Child issues - [ ] `IngestVulnerabilities::Update` order by `vulnerability_id` (the 2026-06-16 deadlock site) - [ ] `IngestVulnerabilityStatistics` order by `project_id` (the 2026-06-17 deadlock site) - [ ] `IngestFindings` order by `uuid` (preserve `after_ingest` index alignment) - [ ] `IngestVulnerabilities::Create` order by `uuid` (preserve `after_ingest` index alignment) - [ ] Audit and fix the remaining shared `SEC_DB_TASKS` (reads, identifiers links, signatures, flags, namespace statistics, risk scores, remediations, attach findings) - [ ] `Security::SyncFindingEnrichmentWorker` order the `security_finding_enrichments` bulk update by `cve_enrichment_id` (separate writer flagged on the issue) - [ ] Add a RuboCop cop that flags unordered bulk upserts/updates in the ingestion namespace to prevent regressions ## Reference Root cause and production evidence: gitlab-org/gitlab#602806