> This issue was previously the rollout issue for `malicious_vulnerability_filter_group` and `malicious_vulnerability_filter_project`. Both flags have been removed. The issue has been retitled and repurposed because `config/feature_flags/beta/vulnerability_malware_detection.yml` sets its `rollout_issue_url` to this issue. Comments predating 2026-08-26 refer to the old flags; flag-state change log entries from 2026-08-26 onward refer to the current flag. ## Summary Rollout issue for the `vulnerability_malware_detection` feature flag, introduced in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/249360. The flag consolidates four previously separate gates on malware-related vulnerability functionality into one flag with widened actor resolution. ## What this flag replaces This is not a new capability, it is a consolidation. The following are all removed from master and superseded by `vulnerability_malware_detection`: - `malicious_vulnerability_filter_project` and `malicious_vulnerability_filter_group`, which gated the `malware` filter argument on the `vulnerabilities` and `vulnerabilitySeveritiesCount` GraphQL queries in `ee/app/graphql/resolvers/vulnerability_filterable.rb`. - `sscs_malware_detection`, which gated `Vulnerabilities::MalwareDetection.malware_detection_enabled_for?`, and therefore whether `Vulnerability#malware` was exposed at all. - The vulnerability-report half of the frontend flag `malicious_package_detection`, split out by https://gitlab.com/gitlab-org/gitlab/-/merge_requests/249418 into its own frontend flag, `vulnerabilityMalwareDetection`. ## Feature flag | Flag | Type | Actor | Default | |---|---|---|---| | `vulnerability_malware_detection` | beta | Project or Group | disabled | - Milestone: 19.0 - Group: group::vulnerability management - Feature issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/587647 ## Surfaces gated Backend: | Surface | What it gates | |---|---| | GraphQL `VulnerabilityType` | the `malware` field (`ee/app/graphql/types/vulnerability_type.rb`) | | Vulnerability entity serializer | the `malware` key | | `Resolvers::VulnerabilitiesResolver` | the `malware` filter argument | Frontend (flag is pushed to the browser as `vulnerabilityMalwareDetection` via `push_force_frontend_feature_flag` from `Projects::Security::VulnerabilitiesController`, `Projects::Security::VulnerabilityReportController` and `Groups::Security::VulnerabilitiesController`): | Surface | What it gates | |---|---| | Vulnerability report list (`vulnerability_list.vue`) | malware badge | | Vulnerability report filtered search (`vulnerability_report_filtered_search.vue`) | malware filter token | | Vulnerability details page (`footer.vue`, `vulnerability_details.vue`, `vulnerability_details_enrichment/risk.vue`, `vulnerability_details_enrichment/remediation.vue`) | malware panels/sections | ## Actor resolution `Project#vulnerability_malware_detection_feature_flag_enabled?` returns `group&.vulnerability_malware_detection_feature_flag_enabled? || Feature.enabled?(:vulnerability_malware_detection, self, type: :beta)`, and the `Group` equivalent uses `feature_flag_enabled_for_self_or_ancestor?`. This means the flag can be enabled on a project directly, or on any ancestor group, and enablement cascades down to descendants. This is a widening compared to the old `malicious_package_detection` flag, which was pushed with `root_ancestor` as the actor. ## What could go wrong - The `malware` filter is implemented only in the Elasticsearch path (`by_malware` in `ee/lib/search/elastic/vulnerability_filters.rb`). It has no equivalent in the Postgres finder. The filter therefore requires advanced search configured and advanced vulnerability management enabled; without those, the filter token is visible but filtering silently does nothing. - Otherwise the blast radius is read-only: badge rendering and query filtering, with no write path affected. ## Current rollout state - Enabled on `pre` (2026-08-26). - Enabled on `gprd` scoped to a single project (2026-08-26). ## Rollout steps Non-production: ``` /chatops gitlab run feature set vulnerability_malware_detection true --dev --pre --staging --staging-ref ``` Production, staged percentage rollout: ``` /chatops gitlab run feature set vulnerability_malware_detection 10 --actors /chatops gitlab run feature set vulnerability_malware_detection 50 --actors /chatops gitlab run feature set vulnerability_malware_detection 100 --actors ``` - [ ] Enabled on non-production environments - [ ] Enabled on 10% of actors in production - [ ] Enabled on 50% of actors in production - [ ] Enabled on 100% of actors in production - [ ] Confirmed no regressions ## Verification checklist - [ ] Malware badge appears on the vulnerability report list for affected vulnerabilities - [ ] Malware filter token appears in the vulnerability report filtered search, and filters results when advanced search and advanced vulnerability management are configured - [ ] Vulnerability details page shows malware-related panels (footer, risk, remediation) - [ ] GraphQL `malware` field on `VulnerabilityType` returns data as expected ## Rollback ``` /chatops gitlab run feature set vulnerability_malware_detection false --actors /chatops gitlab run feature set vulnerability_malware_detection false --dev --pre --staging --staging-ref ``` ## Cleanup - [ ] Remove the `Feature.enabled?(:vulnerability_malware_detection, ...)` checks - [ ] Delete `config/feature_flags/beta/vulnerability_malware_detection.yml` - [ ] Run: ``` /chatops gitlab run feature delete vulnerability_malware_detection --dev --pre --staging --staging-ref --production ``` ## Related - Sibling flag rollout for `dependency_malware_detection`: https://gitlab.com/gitlab-org/gitlab/-/issues/611434 - Consolidation merge requests: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/249360, https://gitlab.com/gitlab-org/gitlab/-/merge_requests/249418, https://gitlab.com/gitlab-org/gitlab/-/merge_requests/251948 - Feature issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/587647 - Parent epic: https://gitlab.com/groups/gitlab-org/-/work_items/18456