[007xf]

Description

Expose POLICY_VIOLATION_UPDATED and POLICY_VIOLATION_UPDATED_REVIEWED as independent choices in event-based portfolio alerts. Existing creation-only subscriptions remain unchanged. The help text explains stable messages, review/suppression exclusions, preserved decisions and the absence of historical replay.

Addressed Issue

Companion to DependencyTrack/dependency-track#7908, addressing DependencyTrack/dependency-track#7649.

User documentation: DependencyTrack/docs#324.

Additional Details

Both choices use the existing notifyOn payload. Neither is selected automatically, and neither appears for system or scheduled alerts. The descriptions have unique accessible associations for each expanded alert. English text is added to en.json; the same keys are null in the other 14 locales, following the localization convention and existing English fallback.

The new browser scenarios use a real API Server, PostgreSQL and the actual alert editor. They cover empty, ordinary-only, reviewed-only and combined subscriptions, exact saved request data, reload/persistence, creation-only compatibility, unsubscribe, and scope/trigger restrictions. Existing notification alert scenarios also run unchanged.

The E2E setup now converts its compose file URL using fileURLToPath, preserving filesystem paths containing spaces or non-ASCII characters when passing the existing argument array to Docker. No dependencies or lock files change.

A separate regression-fix commit addresses two issues exposed by the complete run. A project initialization could finish after navigating back and activate a removed tab; a one-line existence check retains the original fast-navigation and scroll assertions. Session-expiration tests now wait for their source page's initial license/portfolio responses to finish before revoking the session. The original main reproduces the project error, and a controlled real-request diagnostic shows that revoking during initial loading correctly returns 401 and redirects before the intended next click. No unauthorized-response handling, final redirect assertion, retry setting, or error gate is relaxed.

This requires an API Server containing DependencyTrack/dependency-track#7908. Frontend main CI uses 5-snapshot, so these new API-dependent scenarios require that backend change to merge and a supporting image to be published. The local run uses the image built from that implementation; its production code is identical to the current backend PR head.

Validation on Node 26.7.0/npm 11.19.0, real PostgreSQL 18.6, and pinned Playwright 1.64.1 / Chromium headless shell 156.0.8078.4:

• npm ci passed with the unchanged lock file.
• npm run prettier-fix, npm run prettier, npm run eslint, npm run vue-i18n-extract, and npm run build passed.
• npm test: 27 passed, zero failed/skipped.
• Notification UI regression: 11 passed, zero failed/skipped, including all eight new cases.
• Final complete E2E: 278 passed, including all 270 existing cases and eight new cases; zero failed, skipped, flaky, or retried, in 128.325 seconds.
• The two original affected classes also passed all 80 repeated executions (eight cases repeated ten times), without retries. Historical failures and the unchanged-main comparison were retained for diagnosis.

The official Playwright installer installed the exact pinned headless shell and FFmpeg in an isolated browser cache. Canonical HTTPS artifacts were cached locally to work around slow downloads; browser versions and test assertions were not replaced. Every browser test runs without retries. Test notification rules use Console, and the local API's HTTP allowlist only permits the local Hydra service; no external notification destination is used.

The unchanged dependency lock currently has six npm audit findings (three high, three moderate). This change adds no dependencies and does not claim to resolve those baseline findings.

Build output also retains baseline large-chunk and SBOM-plugin auto-registration diagnostics; a successful build does not establish a complete SBOM audit. Both commits carry the contributor's DCO sign-off.

Checklist

• I have read and understand the contributing guidelines
• This PR introduces new or alters existing behavior, and I have updated the documentation accordingly (Companion documentation PR Document policy violation message update notifications docs#324.)