Bala Kumar (41fb1d52) at 18 Mar 11:32

... and 260 more commits

@maddievn backfill_vulnerability_occurrence_id is dependent on a BBM and it will be skipped till the dependent BBM is completed so it is not sequenced and we require this check.

Bala Kumar (4ffb296e) at 17 Mar 17:59

Bala Kumar (8323b64e) at 17 Mar 17:46

Bala Kumar (1f022f54) at 17 Mar 17:42

Migration stubbing for the migrations can be done using the spec helper. Using this helper will set the migrations before it to be completed and the assigned migration as false.

  set_elasticsearch_migration_to :my_migration_name, including: false

TODO:

Consider the checkpoint implementations discussed in #593080 (comment 3150243990)

Thanks for the clear and detailed breakdown @adil.farrukh. Sounds good 👍🏽

advanced vulnerability management docs section includes the list of features/filters it supports. Maintaining a list here will become outdated.

Bala Kumar (a944a1dd) at 17 Mar 13:04

Bala Kumar (620a224e) at 17 Mar 12:57

Bala Kumar (55daeda1) at 17 Mar 12:47

@hmehra Can you review from groupauthorization. There are no logical changes, since the file is touched we need the group's review.

@srushik Can you review the backend and if good pass to @subashis for maintainer review.

Bala Kumar (58341a62) at 17 Mar 12:30

Bala Kumar (b5d788ac) at 17 Mar 12:27

We are already using ES for aggregations and counts on the new security dashboard without issues and also this API is currently returning full counts when any of the advanced vulnerability management filters are included.

Bala Kumar (8bdddec2) at 17 Mar 12:16

Bala Kumar (04ab234d) at 17 Mar 12:09

What does this MR do and why?

Removes the advanced_vulnerability_management feature flag which has been stable since GitLab 18.2 and was default-enabled in the same milestone via !193929 for gitlab.com and Dedicated.

On GitLab self-managed this feature was available from %18.7 and since then we have not received any customer complaints, so we can remove the FF.

Closes #555055

Changes

Feature flag removal

• Deletes ee/config/feature_flags/beta/advanced_vulnerability_management.yml

Policy cleanup

• Removes the advanced_vulnerability_management_enabled? method and its Feature.enabled? checks from Vulnerabilities::AdvancedVulnerabilityManagementPolicy
• The can_access_vulnerability_es_features condition now relies solely on advanced_vulnerability_management_allowed? (the ES/infrastructure check via Search::Elastic::VulnerabilityIndexHelper)

GraphQL description updates

• Removes all references to the advanced_vulnerability_management feature flag from argument descriptions in:
  • Resolvers::VulnerabilitiesResolver
  • Resolvers::VulnerabilitySeveritiesCountResolver
• Also removes the stale TODO comment in counts_from_es

Documentation

• Updates doc/user/application_security/vulnerability_report/_index.md to:
  • Remove the > [!flag] callout from the Advanced vulnerability management section
  • Add "Generally available in GitLab 18.11. Feature flag advanced_vulnerability_management removed." to both history entries (the section header and the inline filter history)

Tests

• Removes the stub_feature_flags(advanced_vulnerability_management: false) test context from the policy spec since the flag no longer exists

MR acceptance checklist

• Confirm the feature flag is deleted from all environments before merging

Bala Kumar (e0631263) at 17 Mar 12:03