From 16e41e0a475e17e09fd258376759cd2ec0b0e9ee Mon Sep 17 00:00:00 2001
From: Brian Williams <bwilliams@gitlab.com>
Date: Wed, 8 Oct 2025 16:49:18 -0500
Subject: [PATCH] Remove feature flag to hide no longer detected
 vulnerabilities

Changelog: changed
EE: true
---
 .../components/dependencies_table.vue         | 27 +++++++------------
 .../groups/dependencies_controller.rb         |  1 -
 .../projects/dependencies_controller.rb       |  1 -
 .../sbom/ingestion/vulnerability_data.rb      |  7 +----
 ...vulnerabilities_on_the_dependency_list.yml | 10 -------
 .../components/dependencies_table_spec.js     | 23 ----------------
 .../groups/dependencies_controller_spec.rb    |  7 -----
 .../projects/dependencies_controller_spec.rb  |  7 -----
 .../sbom/ingestion/vulnerability_data_spec.rb | 13 ---------
 9 files changed, 11 insertions(+), 85 deletions(-)
 delete mode 100644 ee/config/feature_flags/gitlab_com_derisk/hide_no_longer_detected_vulnerabilities_on_the_dependency_list.yml

diff --git a/ee/app/assets/javascripts/dependencies/components/dependencies_table.vue b/ee/app/assets/javascripts/dependencies/components/dependencies_table.vue
index 7e0be2b0927c55..cade22c41b5347 100644
--- a/ee/app/assets/javascripts/dependencies/components/dependencies_table.vue
+++ b/ee/app/assets/javascripts/dependencies/components/dependencies_table.vue
@@ -11,7 +11,6 @@ import {
 } from '@gitlab/ui';
 import { cloneDeep } from 'lodash';
 import { DOCS_URL_IN_EE_DIR } from 'jh_else_ce/lib/utils/url_utility';
-import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { NAMESPACE_PROJECT, DEPENDENCIES_TABLE_I18N } from '../constants';
 import DependencyLicenseLinks from './dependency_license_links.vue';
 import DependencyLocation from './dependency_location.vue';
@@ -65,7 +64,6 @@ export default {
     GlLink,
     GlLoadingIcon,
   },
-  mixins: [glFeatureFlagsMixin()],
   inject: ['namespaceType'],
   props: {
     dependencies: {
@@ -108,9 +106,6 @@ export default {
     showDrawer() {
       return this.drawerId !== null;
     },
-    showVulnerabilitiesInfo() {
-      return this.glFeatures.hideNoLongerDetectedVulnerabilitiesOnTheDependencyList;
-    },
   },
   methods: {
     // The GlTable component mutates the `_showDetails` property on items
@@ -220,18 +215,16 @@ export default {
 
       <template #head(isVulnerable)="data">
         {{ data.label }}
-        <div v-if="showVulnerabilitiesInfo">
-          <gl-icon id="vulnerabilities-info" name="information-o" class="gl-ml-2" variant="info" />
-          <gl-popover
-            placement="bottom"
-            boundary="viewport"
-            target="vulnerabilities-info"
-            data-testid="vulnerability-info-popover"
-            :title="$options.i18n.vulnerabilityInfoTitle"
-          >
-            <p class="gl-mb-0">{{ $options.i18n.vulnerabilityInfoBody }}</p>
-          </gl-popover>
-        </div>
+        <gl-icon id="vulnerabilities-info" name="information-o" class="gl-ml-2" variant="info" />
+        <gl-popover
+          placement="bottom"
+          boundary="viewport"
+          target="vulnerabilities-info"
+          data-testid="vulnerability-info-popover"
+          :title="$options.i18n.vulnerabilityInfoTitle"
+        >
+          <p class="gl-mb-0">{{ $options.i18n.vulnerabilityInfoBody }}</p>
+        </gl-popover>
       </template>
 
       <!-- toggleDetails and detailsShowing are scoped slot props provided by
diff --git a/ee/app/controllers/groups/dependencies_controller.rb b/ee/app/controllers/groups/dependencies_controller.rb
index f46679b1a2ebc9..96bde1e50dfa65 100644
--- a/ee/app/controllers/groups/dependencies_controller.rb
+++ b/ee/app/controllers/groups/dependencies_controller.rb
@@ -8,7 +8,6 @@ class DependenciesController < Groups::ApplicationController
     before_action only: :index do
       push_frontend_feature_flag(:dependency_paths, group)
       push_frontend_feature_flag(:group_dependencies_graphql, group)
-      push_frontend_feature_flag(:hide_no_longer_detected_vulnerabilities_on_the_dependency_list)
     end
 
     before_action :authorize_read_dependency_list!
diff --git a/ee/app/controllers/projects/dependencies_controller.rb b/ee/app/controllers/projects/dependencies_controller.rb
index bc20cc816c621a..25ea941a4f07d5 100644
--- a/ee/app/controllers/projects/dependencies_controller.rb
+++ b/ee/app/controllers/projects/dependencies_controller.rb
@@ -9,7 +9,6 @@ class DependenciesController < Projects::ApplicationController
     before_action only: :index do
       push_frontend_feature_flag(:dependency_paths, project)
       push_frontend_feature_flag(:project_dependencies_graphql, project.group)
-      push_frontend_feature_flag(:hide_no_longer_detected_vulnerabilities_on_the_dependency_list, project)
     end
 
     before_action :authorize_read_dependency_list!
diff --git a/ee/app/services/sbom/ingestion/vulnerability_data.rb b/ee/app/services/sbom/ingestion/vulnerability_data.rb
index 472da00662a24c..ec8977851ea72e 100644
--- a/ee/app/services/sbom/ingestion/vulnerability_data.rb
+++ b/ee/app/services/sbom/ingestion/vulnerability_data.rb
@@ -82,10 +82,9 @@ def fetch_vulnerabilities_info
                   .by_report_types(%i[container_scanning dependency_scanning])
                   .by_projects(project)
                   .active
+                  .merge(Vulnerability.with_resolution(false))
                   .group("occurrence_maps.name, occurrence_maps.version, occurrence_maps.path")
 
-        query = query.merge(Vulnerability.with_resolution(false)) if hide_no_longer_detected?
-
         full_query = [cte_sql, query.to_sql].join("\n")
         results = ::Vulnerabilities::Finding.connection.execute(full_query)
 
@@ -104,10 +103,6 @@ def fetch_vulnerabilities_info
         # rubocop:enable CodeReuse/ActiveRecord
       end
 
-      def hide_no_longer_detected?
-        Feature.enabled?(:hide_no_longer_detected_vulnerabilities_on_the_dependency_list, project)
-      end
-
       class VulnerabilityInfo
         def initialize(data)  = @data = data || {}
         def count             = @data[:vulnerability_count] || 0
diff --git a/ee/config/feature_flags/gitlab_com_derisk/hide_no_longer_detected_vulnerabilities_on_the_dependency_list.yml b/ee/config/feature_flags/gitlab_com_derisk/hide_no_longer_detected_vulnerabilities_on_the_dependency_list.yml
deleted file mode 100644
index c73f97d02504c2..00000000000000
--- a/ee/config/feature_flags/gitlab_com_derisk/hide_no_longer_detected_vulnerabilities_on_the_dependency_list.yml
+++ /dev/null
@@ -1,10 +0,0 @@
----
-name: hide_no_longer_detected_vulnerabilities_on_the_dependency_list
-description:
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/353487
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/206275
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/572129
-milestone: '18.5'
-group: group::security insights
-type: gitlab_com_derisk
-default_enabled: false
diff --git a/ee/spec/frontend/dependencies/components/dependencies_table_spec.js b/ee/spec/frontend/dependencies/components/dependencies_table_spec.js
index 6131c2cc96b05a..c2dc65137af090 100644
--- a/ee/spec/frontend/dependencies/components/dependencies_table_spec.js
+++ b/ee/spec/frontend/dependencies/components/dependencies_table_spec.js
@@ -23,9 +23,6 @@ describe('DependenciesTable component', () => {
     namespaceType: 'project',
     endpoint: 'endpoint',
     locationsEndpoint: 'endpoint',
-    glFeatures: {
-      hideNoLongerDetectedVulnerabilitiesOnTheDependencyList: true,
-    },
   };
 
   const createComponent = ({ propsData, provide } = {}) => {
@@ -190,26 +187,6 @@ describe('DependenciesTable component', () => {
         );
       });
 
-      describe('when hideNoLongerDetectedVulnerabilitiesOnTheDependencyList is false', () => {
-        beforeEach(() => {
-          createComponent({
-            propsData: {
-              dependencies: [],
-              isLoading: false,
-            },
-            provide: {
-              namespaceType,
-              glFeatures: { hideNoLongerDetectedVulnerabilitiesOnTheDependencyList: false },
-            },
-          });
-        });
-
-        it('does not render the icon or popover', () => {
-          expect(findVulnerabilityInfoIcon().exists()).toBe(false);
-          expect(findVulnerabilityInfoPopover().exists()).toBe(false);
-        });
-      });
-
       it('renders a message that there are no records to show', () => {
         expect(wrapper.text()).toContain('There are no records to show');
       });
diff --git a/ee/spec/requests/groups/dependencies_controller_spec.rb b/ee/spec/requests/groups/dependencies_controller_spec.rb
index 9dd1f1a7344968..149a7e8287d780 100644
--- a/ee/spec/requests/groups/dependencies_controller_spec.rb
+++ b/ee/spec/requests/groups/dependencies_controller_spec.rb
@@ -30,13 +30,6 @@
             expect(response).to have_gitlab_http_status(:ok)
           end
 
-          it 'pushes hideNoLongerDetectedVulnerabilitiesOnTheDependencyList feature flag' do
-            subject
-
-            expect(response.body).to have_pushed_frontend_feature_flags(
-              hideNoLongerDetectedVulnerabilitiesOnTheDependencyList: true)
-          end
-
           it 'returns the correct template' do
             subject
 
diff --git a/ee/spec/requests/projects/dependencies_controller_spec.rb b/ee/spec/requests/projects/dependencies_controller_spec.rb
index a14dc9b347de38..ccd6a7988bd0af 100644
--- a/ee/spec/requests/projects/dependencies_controller_spec.rb
+++ b/ee/spec/requests/projects/dependencies_controller_spec.rb
@@ -33,13 +33,6 @@
           stub_licensed_features(dependency_scanning: true, license_scanning: true, security_dashboard: true)
         end
 
-        it 'pushes hideNoLongerDetectedVulnerabilitiesOnTheDependencyList feature flag' do
-          show_dependency_list
-
-          expect(response.body).to have_pushed_frontend_feature_flags(
-            hideNoLongerDetectedVulnerabilitiesOnTheDependencyList: true)
-        end
-
         context 'when project has sbom_occurrences' do
           let_it_be(:registry_occurrence) { create(:sbom_occurrence, :registry_occurrence, project: project) }
           let_it_be(:occurrences) do
diff --git a/ee/spec/services/sbom/ingestion/vulnerability_data_spec.rb b/ee/spec/services/sbom/ingestion/vulnerability_data_spec.rb
index 888f5454b4c645..1ec9141b74ebda 100644
--- a/ee/spec/services/sbom/ingestion/vulnerability_data_spec.rb
+++ b/ee/spec/services/sbom/ingestion/vulnerability_data_spec.rb
@@ -104,19 +104,6 @@
         let(:finding) { dependency_scanning_finding }
 
         it_behaves_like 'when vulnerability data is expected'
-
-        context 'when hide_no_longer_detected_vulnerabilities_on_the_dependency_list is disabled' do
-          before do
-            stub_feature_flags(hide_no_longer_detected_vulnerabilities_on_the_dependency_list: false)
-          end
-
-          it 'includes no longer detected vulnerabilities' do
-            expect(vulnerability_info.count).to eq(2)
-            expect(vulnerability_info.highest_severity).to eq(expected_severity)
-            expect(vulnerability_info.vulnerability_ids).to match_array([finding.vulnerability_id,
-              no_longer_detected_vulnerability.id])
-          end
-        end
       end
 
       context 'with a container scanning finding' do
-- 
GitLab