## Goal Take Malicious Packages from Beta to GA across all five readiness areas: advisory sync, SBOM/dependency-scanning CI integration, CVS (continuous vulnerability scanning) integration, the Elasticsearch SBOM index behind dependency-list filtering, and malware policy enforcement. Reaching GA requires closing out the remaining GA-blocking work tracked in the two underlying feature epics, removing all eight Beta feature flags now that the feature has run in production, and bringing the user-facing documentation up to date so it no longer describes a Beta, flag-gated capability. ## GA-blocking work - [x] Complete the GA wave (Wave 4) of sync epic https://gitlab.com/groups/gitlab-org/-/work_items/20876#wave-4--large-file--ga-hardening-follow-ups - [x] Close the issues in Wave 2 of the SBOM CI / CVS integration epic https://gitlab.com/groups/gitlab-org/-/work_items/21156#wave-2--cvs-integration-194 ## Feature-flag removals (Beta → GA) All eight flags are currently `default_enabled: true`. Each should be removed only once its area is confirmed stable at GA, not before. One checkbox per removal issue, grouped by area: - [x] Sync — https://gitlab.com/gitlab-org/gitlab/-/work_items/613598 (`sync_malware_advisories`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258754 - [x] Sync — https://gitlab.com/gitlab-org/gitlab/-/work_items/613599 (`ingest_malware_advisories`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258755 - [x] Malware policy — https://gitlab.com/gitlab-org/gitlab/-/work_items/601969 (`security_policies_malware_attribute`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258759 - [x] CVS integration — https://gitlab.com/gitlab-org/gitlab/-/work_items/629303 (`cvs_malware_advisories`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258756 - [x] CVS integration — https://gitlab.com/gitlab-org/gitlab/-/work_items/629304 (`vulnerability_malware_detection`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/260114 - [x] SBOM CI integration — https://gitlab.com/gitlab-org/gitlab/-/work_items/629305 (`sbom_scan_malware_findings`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258731 - [x] SBOM CI integration — https://gitlab.com/gitlab-org/gitlab/-/work_items/629306 (`dependency_malware_detection`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258729 - [x] ES SBOM index — https://gitlab.com/gitlab-org/gitlab/-/work_items/629307 (`malicious_packages_dependency_list_filtering`) — removal MR: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/258728 ## Documentation - [x] https://gitlab.com/gitlab-org/gitlab/-/work_items/629308 — docs GA and GraphQL experiment-status cleanup (https://gitlab.com/gitlab-org/gitlab/-/merge_requests/260786)