@oneuptime/common 12.0.6 → 12.0.7

package/Server/Utils/DataSource/HttpFetch.ts

@@ -1,5 +1,3 @@
-import http from "http";
-import https from "https";
 import axios, { AxiosRequestConfig, AxiosResponse } from "axios";
 import API from "../../../Utils/API";
 import Dictionary from "../../../Types/Dictionary";
@@ -8,10 +6,7 @@ import {
   DATA_SOURCE_MAX_RESPONSE_SIZE_IN_BYTES,
   DATA_SOURCE_QUERY_TIMEOUT_IN_MS,
 } from "../../../Types/DataSource/DataSourceLimits";
-import DataSourceEgressGuard, {
-  EgressGuardOptions,
-  ResolvedAddress,
-} from "./EgressGuard";
+import DataSourceEgressGuard, { EgressGuardOptions } from "./EgressGuard";
 import { DataSourceConnectionSettings } from "./Types";
 
 /*
@@ -54,12 +49,6 @@ export interface DataSourceHttpResponse {
   bodyJson: unknown;
 }
 
-type LookupCallback = (
-  error: NodeJS.ErrnoException | null,
-  address: string | Array<{ address: string; family: number }>,
-  family?: number,
-) => void;
-
 export default class DataSourceHttpFetch {
   /*
    * Standard auth headers for a data source: Bearer token wins, else HTTP
@@ -92,44 +81,16 @@ export default class DataSourceHttpFetch {
   public static async fetch(
     request: DataSourceHttpRequest,
   ): Promise<DataSourceHttpResponse> {
-    const { url, addresses } = await DataSourceEgressGuard.assertUrlAllowed(
-      request.url,
-      request.egressOptions,
-    );
-
     /*
      * Pin the validated addresses: whatever getaddrinfo said at validation
      * time is what the socket dials, even if DNS answers differently a
      * millisecond later.
      */
-    const pinnedLookup: (
-      hostname: string,
-      options: { all?: boolean },
-      callback: LookupCallback,
-    ) => void = (
-      _hostname: string,
-      options: { all?: boolean },
-      callback: LookupCallback,
-    ): void => {
-      const first: ResolvedAddress = addresses[0]!;
-      if (options && options.all) {
-        callback(
-          null,
-          addresses.map((resolved: ResolvedAddress) => {
-            return { address: resolved.address, family: resolved.family };
-          }),
-        );
-        return;
-      }
-      callback(null, first.address, first.family);
-    };
-
-    const httpAgent: http.Agent = new http.Agent({
-      lookup: pinnedLookup as never,
-    });
-    const httpsAgent: https.Agent = new https.Agent({
-      lookup: pinnedLookup as never,
-    });
+    const { url, httpAgent, httpsAgent } =
+      await DataSourceEgressGuard.assertUrlAllowedAndPin(
+        request.url,
+        request.egressOptions,
+      );
 
     const headers: Dictionary<string> = { ...(request.headers || {}) };
 

package/Server/Utils/Execute.ts

@@ -74,6 +74,13 @@ export default class Execute {
      * (e.g. `git log` over a huge full-history repo) can never hang the caller.
      */
     timeoutInMS?: number | undefined;
+    /*
+     * Environment for the child. Replaces this process's environment entirely
+     * when given, so a caller can hand a secret to ONE child (a git askpass
+     * token) without putting it in process.env, where every other child —
+     * including an AI agent's shell commands — would inherit it.
+     */
+    env?: NodeJS.ProcessEnv | undefined;
   }): Promise<string> {
     return new Promise(
       (
@@ -89,6 +96,7 @@ export default class Execute {
             ...(data.timeoutInMS
               ? { timeout: data.timeoutInMS, killSignal: "SIGKILL" }
               : {}),
+            ...(data.env ? { env: data.env } : {}),
           },
           (
             err: ExecFileException | null,

package/Server/Utils/InlineImageAccessTokenSync.ts

@@ -81,3 +81,26 @@ export const setIsPublicForMarkdownImages: (
     }
   }
 };
+
+/*
+ * Best-effort variant used by the publish paths (public notes,
+ * announcements). Failing to flip an inline image must never fail the
+ * write the user actually asked for, so errors are logged and swallowed.
+ */
+export const syncIsPublicForMarkdownImages: (
+  markdown: string | null | undefined,
+  isPublic: boolean,
+  context: string,
+) => Promise<void> = async (
+  markdown: string | null | undefined,
+  isPublic: boolean,
+  context: string,
+): Promise<void> => {
+  try {
+    await setIsPublicForMarkdownImages(markdown, isPublic);
+  } catch (err) {
+    logger.error(
+      `Failed to sync inline image visibility for ${context}: ${String(err)}`,
+    );
+  }
+};

package/Server/Utils/LLM/LLMService.ts

@@ -4,11 +4,12 @@ import Headers from "../../../Types/API/Headers";
 import URL from "../../../Types/API/URL";
 import { JSONArray, JSONObject } from "../../../Types/JSON";
 import JSONFunctions from "../../../Types/JSONFunctions";
-import API from "../../../Utils/API";
+import API, { RequestOptions } from "../../../Utils/API";
 import LlmType from "../../../Types/LLM/LlmType";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
+import DataSourceEgressGuard from "../DataSource/EgressGuard";
 
 export interface LLMToolDefinition {
   name: string;
@@ -653,6 +654,38 @@ export default class LLMService {
    * the offending parameter in the 400 — one parameter per response, hence the
    * loop.
    */
+  /*
+   * Request options for a call to a tenant-configured LLM endpoint.
+   *
+   * LlmProvider.baseUrl is writable by any project member while reading the
+   * apiKey is Owner/Admin-only, so an unguarded request lets a member repoint
+   * a provider at a host they control and collect the decrypted key out of the
+   * auth header — and, because provider error bodies are reflected back
+   * through the LLM provider API, use the same lever as a blind-free read
+   * primitive against the internal network.
+   *
+   * The address the guard checked is pinned into the socket, and redirects are
+   * refused: pinning covers only the validated host, so a 3xx would walk
+   * around it. Private ranges stay reachable on self-hosted installs, because
+   * a self-hosted Ollama on 10.x is the documented deployment.
+   */
+  private static async buildGuardedRequestOptions(
+    requestUrl: string,
+    options: RequestOptions,
+  ): Promise<RequestOptions> {
+    const { httpAgent, httpsAgent } =
+      await DataSourceEgressGuard.assertUrlAllowedAndPin(requestUrl, {
+        targetLabel: "LLM provider",
+      });
+
+    return {
+      ...options,
+      doNotFollowRedirects: true,
+      httpAgent,
+      httpsAgent,
+    };
+  }
+
   private static async postOpenAIChatCompletion(data: {
     requestUrl: string;
     headers: Headers;
@@ -674,6 +707,18 @@ export default class LLMService {
      */
     const attemptedTokenLimitParams: Set<TokenLimitParam> = new Set();
 
+    /*
+     * Validated once, before the first request: the adaptation loop below
+     * re-posts to the same URL, so re-resolving per attempt would only add
+     * DNS round trips (and a rebind window between them).
+     */
+    const requestOptions: RequestOptions =
+      await this.buildGuardedRequestOptions(data.requestUrl, {
+        retries: data.request.requestRetries ?? 2,
+        exponentialBackoff: true,
+        timeout: data.request.requestTimeoutInMs ?? 120000,
+      });
+
     const post: () => Promise<
       HTTPResponse<JSONObject> | HTTPErrorResponse
     > = (): Promise<HTTPResponse<JSONObject> | HTTPErrorResponse> => {
@@ -693,11 +738,7 @@ export default class LLMService {
         url: URL.fromString(data.requestUrl),
         data: body,
         headers: data.headers,
-        options: {
-          retries: data.request.requestRetries ?? 2,
-          exponentialBackoff: true,
-          timeout: data.request.requestTimeoutInMs ?? 120000,
-        },
+        options: requestOptions,
       });
     };
 
@@ -1214,20 +1255,22 @@ export default class LLMService {
       requestData["tools"] = anthropicTools;
     }
 
+    const anthropicRequestUrl: string = `${baseUrl}/messages`;
+
     const response: HTTPErrorResponse | HTTPResponse<JSONObject> =
       await API.post<JSONObject>({
-        url: URL.fromString(`${baseUrl}/messages`),
+        url: URL.fromString(anthropicRequestUrl),
         data: requestData,
         headers: {
           "x-api-key": config.apiKey,
           "anthropic-version": "2023-06-01",
           "Content-Type": "application/json",
         },
-        options: {
+        options: await this.buildGuardedRequestOptions(anthropicRequestUrl, {
           retries: request.requestRetries ?? 2,
           exponentialBackoff: true,
           timeout: request.requestTimeoutInMs ?? 120000,
-        },
+        }),
       });
 
     const anthropicLogAttributes: LogAttributes = {
@@ -1355,18 +1398,20 @@ export default class LLMService {
       requestData["tools"] = this.toOpenAITools(request.tools);
     }
 
+    const ollamaRequestUrl: string = `${config.baseUrl}/api/chat`;
+
     const response: HTTPErrorResponse | HTTPResponse<JSONObject> =
       await API.post<JSONObject>({
-        url: URL.fromString(`${config.baseUrl}/api/chat`),
+        url: URL.fromString(ollamaRequestUrl),
         data: requestData,
         headers: {
           "Content-Type": "application/json",
         },
-        options: {
+        options: await this.buildGuardedRequestOptions(ollamaRequestUrl, {
           retries: request.requestRetries ?? 2,
           exponentialBackoff: true,
           timeout: request.requestTimeoutInMs ?? 300000, // Ollama may be slower
-        },
+        }),
       });
 
     const ollamaLogAttributes: LogAttributes = {

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -36,6 +36,9 @@ import MonitorClusterContextUtil, {
   MonitorClusterContext,
 } from "./MonitorClusterContext";
 import MonitorTemplateUtil from "./MonitorTemplateUtil";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import { JSONObject } from "../../../Types/JSON";
 import OneUptimeDate from "../../../Types/Date";
 import MonitorEvaluationSummary from "../../../Types/Monitor/MonitorEvaluationSummary";
@@ -240,6 +243,14 @@ export default class MonitorAlert {
      * evaluating. See MonitorMaintenanceSuppression.
      */
     suppressedSeriesFingerprints?: Set<string> | undefined;
+    /**
+     * Alert-dependency suppression: when set and isSuppressed, a parent
+     * monitor this monitor depends on is currently in a suppressing
+     * status, so ALL alert creation for this evaluation is skipped. Only
+     * creation — already-open alerts still follow the normal resolve
+     * path above. See MonitorDependencySuppression.
+     */
+    dependencySuppression?: DependencySuppressionResult | undefined;
     /**
      * Event-driven monitors (incoming-request / webhook fan-out) must not
      * use the metric snapshot model where a series absent from this tick's
@@ -288,6 +299,35 @@ export default class MonitorAlert {
       return;
     }
 
+    /*
+     * Alert-dependency suppression: a parent monitor is in a suppressing
+     * status (offline by default), so skip creating any alert for this
+     * evaluation. Placed after the open-alert resolve pass above on
+     * purpose — an alert raised before the parent went down must still
+     * resolve normally; only new creation is silenced.
+     */
+    if (input.dependencySuppression?.isSuppressed) {
+      const suppressionReason: string =
+        MonitorDependencySuppression.buildSuppressionReason(
+          input.dependencySuppression.suppressingParents,
+        );
+
+      logger.debug(
+        `${input.monitor.id?.toString()} - Skipping alert creation: ${suppressionReason}.`,
+        alertLogAttributes,
+      );
+
+      input.evaluationSummary?.events.push({
+        type: "alert-skipped",
+        title: "Alert suppressed by monitor dependency",
+        message: `Skipped creating alerts because ${suppressionReason}. This monitor's status still updates normally; open alerts still auto-resolve.`,
+        relatedCriteriaId: input.criteriaInstance.data?.id,
+        at: OneUptimeDate.getCurrentDate(),
+      });
+
+      return;
+    }
+
     /*
      * Proxmox/Ceph monitors: resolve the monitored cluster once per
      * evaluation (lookup-only, from the step config's clusterIdentifier)

package/Server/Utils/Monitor/MonitorDependencySuppression.ts

@@ -0,0 +1,192 @@
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import ObjectID from "../../../Types/ObjectID";
+import MonitorDependencyRule, {
+  DependencySuppressionResult,
+  ParentMonitorStatusRef,
+  SuppressingParent,
+} from "../../../Utils/Monitor/MonitorDependencyRule";
+import MonitorService from "../../Services/MonitorService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import logger from "../Logger";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+
+/*
+ * Re-exported so server-side callers (and the existing tests) keep a
+ * single import site; the rule itself lives in
+ * Common/Utils/Monitor/MonitorDependencyRule so the dashboard can share
+ * it without importing server modules.
+ */
+export type {
+  DependencySuppressionResult,
+  ParentMonitorStatusRef,
+  SuppressingParent,
+};
+
+/*
+ * Alert-dependency suppression (the per-monitor counterpart of the
+ * per-series MonitorMaintenanceSuppression): when a monitor declares
+ * `dependsOnMonitors` and any of those parents is currently in a
+ * suppressing status, alert/incident *creation* for this monitor is
+ * skipped for the evaluation. The monitor itself keeps evaluating — its
+ * status timeline, metrics, and the resolve path for already-open
+ * alerts/incidents are untouched. That keeps the child visibly Offline on
+ * status pages (and lets grand-children observe the outage through the
+ * child's real status, which is what makes one-hop checks transitive)
+ * while silencing the redundant paging.
+ *
+ * Which parent statuses suppress: the monitor's
+ * `suppressAlertsWhenParentMonitorStatuses` list when configured,
+ * otherwise any status flagged `isOfflineState`. The decision itself is
+ * MonitorDependencyRule.getSuppressingParents, shared with the dashboard
+ * banner.
+ */
+export default class MonitorDependencySuppression {
+  /*
+   * Resolve the suppression decision for one evaluation. Zero queries on
+   * the common path — a monitor with no dependencies returns immediately —
+   * and exactly one query (the parents' current statuses) otherwise. This
+   * sits on the hottest Postgres path in the product, so the monitor's
+   * dependency ids must arrive pre-selected on the monitor row rather than
+   * being re-read here.
+   */
+  @CaptureSpan()
+  public static async getDependencySuppression(input: {
+    monitor: Monitor;
+  }): Promise<DependencySuppressionResult> {
+    const monitorId: string = (
+      input.monitor.id ||
+      input.monitor._id ||
+      ""
+    ).toString();
+
+    const parentIds: Array<ObjectID> = (input.monitor.dependsOnMonitors || [])
+      .map((parent: Monitor) => {
+        return (parent.id || parent._id)?.toString() || "";
+      })
+      .filter((id: string) => {
+        /*
+         * A self-edge should never exist (validation rejects it, uuids
+         * compared case-insensitively), but if one was persisted through
+         * an older payload shape it must not let a monitor suppress its
+         * own offline alerts — that would silence exactly the outage the
+         * monitor exists to report.
+         */
+        return id.length > 0 && id.toLowerCase() !== monitorId.toLowerCase();
+      })
+      .map((id: string) => {
+        return new ObjectID(id);
+      });
+
+    if (parentIds.length === 0) {
+      return { isSuppressed: false, suppressingParents: [] };
+    }
+
+    const parents: Array<Monitor> = await MonitorService.findBy({
+      query: {
+        _id: QueryHelper.any(parentIds),
+      },
+      select: {
+        _id: true,
+        name: true,
+        currentMonitorStatus: {
+          _id: true,
+          name: true,
+          isOfflineState: true,
+        },
+        /*
+         * The parents' own parent ids, for the runtime mutual-cycle guard
+         * below. Selected here so the guard costs no extra query.
+         */
+        dependsOnMonitors: {
+          _id: true,
+        },
+      },
+      skip: 0,
+      limit: LIMIT_PER_PROJECT,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const parentRefs: Array<ParentMonitorStatusRef> = [];
+
+    for (const parent of parents) {
+      /*
+       * Runtime mutual-cycle guard: write-time validation walks the graph
+       * before persisting, but two concurrent updates can each pass
+       * validation and jointly commit a cycle (A depends on B, B depends
+       * on A). If that cycle suppressed, a shared outage would take both
+       * monitors offline and page NOBODY. Fail open instead: a parent
+       * that itself depends on this monitor is ignored for suppression,
+       * so a raced-in cycle degrades to normal (noisy) paging rather than
+       * a silent blackout.
+       */
+      const isMutualCycle: boolean = (parent.dependsOnMonitors || []).some(
+        (grandParent: Monitor) => {
+          const grandParentId: string = (
+            grandParent.id ||
+            grandParent._id ||
+            ""
+          ).toString();
+
+          return (
+            grandParentId.length > 0 &&
+            grandParentId.toLowerCase() === monitorId.toLowerCase()
+          );
+        },
+      );
+
+      if (isMutualCycle) {
+        logger.warn(
+          `${monitorId} - Monitor dependency cycle detected at evaluation time with parent ${parent.id?.toString()} ("${parent.name}"). The parent is ignored for suppression so alerts still fire. Remove one side of the cycle.`,
+        );
+        continue;
+      }
+
+      parentRefs.push({
+        monitorId: parent.id?.toString() || "",
+        monitorName: parent.name || "Unnamed monitor",
+        statusId: parent.currentMonitorStatus?.id?.toString(),
+        statusName: parent.currentMonitorStatus?.name,
+        isOfflineState: Boolean(parent.currentMonitorStatus?.isOfflineState),
+      });
+    }
+
+    const configuredSuppressionStatusIds: Set<string> = new Set<string>(
+      (input.monitor.suppressAlertsWhenParentMonitorStatuses || [])
+        .map((status: MonitorStatus) => {
+          return (status.id || status._id)?.toString() || "";
+        })
+        .filter((id: string) => {
+          return id.length > 0;
+        }),
+    );
+
+    const suppressingParents: Array<SuppressingParent> =
+      this.getSuppressingParents({
+        parents: parentRefs,
+        configuredSuppressionStatusIds,
+      });
+
+    return {
+      isSuppressed: suppressingParents.length > 0,
+      suppressingParents,
+    };
+  }
+
+  // Delegates kept so callers and tests have one server-side entry point.
+  public static getSuppressingParents(input: {
+    parents: Array<ParentMonitorStatusRef>;
+    configuredSuppressionStatusIds: Set<string>;
+  }): Array<SuppressingParent> {
+    return MonitorDependencyRule.getSuppressingParents(input);
+  }
+
+  public static buildSuppressionReason(
+    suppressingParents: Array<SuppressingParent>,
+  ): string {
+    return MonitorDependencyRule.buildSuppressionReason(suppressingParents);
+  }
+}

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -44,6 +44,9 @@ import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
 import MonitorTemplateUtil from "./MonitorTemplateUtil";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import { JSONObject } from "../../../Types/JSON";
 import OneUptimeDate from "../../../Types/Date";
 import MonitorEvaluationSummary from "../../../Types/Monitor/MonitorEvaluationSummary";
@@ -288,6 +291,14 @@ export default class MonitorIncident {
      * are suppressed at creation time. See MonitorMaintenanceSuppression.
      */
     suppressedSeriesFingerprints?: Set<string> | undefined;
+    /**
+     * Alert-dependency suppression: when set and isSuppressed, a parent
+     * monitor this monitor depends on is currently in a suppressing
+     * status, so ALL incident creation for this evaluation is skipped.
+     * Only creation — already-open incidents still follow the normal
+     * resolve path above. See MonitorDependencySuppression.
+     */
+    dependencySuppression?: DependencySuppressionResult | undefined;
     /**
      * Event-driven monitors (incoming-request / webhook fan-out) must not
      * use the metric snapshot model where a series absent from this tick's
@@ -342,6 +353,35 @@ export default class MonitorIncident {
       return;
     }
 
+    /*
+     * Alert-dependency suppression: a parent monitor is in a suppressing
+     * status (offline by default), so skip creating any incident for this
+     * evaluation. Placed after the open-incident resolve pass above on
+     * purpose — an incident raised before the parent went down must still
+     * resolve normally; only new creation is silenced.
+     */
+    if (input.dependencySuppression?.isSuppressed) {
+      const suppressionReason: string =
+        MonitorDependencySuppression.buildSuppressionReason(
+          input.dependencySuppression.suppressingParents,
+        );
+
+      logger.debug(
+        `${input.monitor.id?.toString()} - Skipping incident creation: ${suppressionReason}.`,
+        incidentLogAttributes,
+      );
+
+      input.evaluationSummary?.events.push({
+        type: "incident-skipped",
+        title: "Incident suppressed by monitor dependency",
+        message: `Skipped creating incidents because ${suppressionReason}. This monitor's status still updates normally; open incidents still auto-resolve.`,
+        relatedCriteriaId: input.criteriaInstance.data?.id,
+        at: OneUptimeDate.getCurrentDate(),
+      });
+
+      return;
+    }
+
     /*
      * Proxmox/Ceph monitors: resolve the monitored cluster once per
      * evaluation (lookup-only, from the step config's clusterIdentifier)

package/Server/Utils/Monitor/MonitorResource.ts

@@ -45,6 +45,9 @@ import MonitorSummaryCapture from "./MonitorSummaryCapture";
 import MonitorSummarySnapshot from "../../../Types/Monitor/MonitorSummarySnapshot";
 import IncomingRequestIncidentGrouping from "./IncomingRequestIncidentGrouping";
 import MonitorMaintenanceSuppression from "./MonitorMaintenanceSuppression";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import MonitorStatusTimelineUtil from "./MonitorStatusTimeline";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import ExceptionMessages from "../../../Types/Exception/ExceptionMessages";
@@ -150,6 +153,21 @@ export default class MonitorResourceUtil {
           name: true,
         },
         customFields: true,
+        /*
+         * Alert-dependency suppression inputs. Selected here for the same
+         * reason as labels: this query already loads the monitor on the
+         * hottest path, and both lists are empty for the overwhelming
+         * majority of monitors, in which case suppression costs nothing.
+         * Ids only — names are fetched by the suppression util's own
+         * parents query, so selecting them here would just duplicate the
+         * joined row payload on every evaluation.
+         */
+        dependsOnMonitors: {
+          _id: true,
+        },
+        suppressAlertsWhenParentMonitorStatuses: {
+          _id: true,
+        },
       },
       props: {
         isRoot: true,
@@ -917,6 +935,22 @@ export default class MonitorResourceUtil {
             matchesPerSeries: response.perSeriesMatches,
           });
 
+        /*
+         * Alert-dependency suppression: if any parent monitor this monitor
+         * depends on is currently in a suppressing status (offline by
+         * default), skip creating incidents/alerts for this evaluation.
+         * Deliberately computed AFTER the status timeline update above —
+         * the child's own status must keep tracking reality (status pages,
+         * transitive dependency checks); only the redundant paging is
+         * silenced. The resolve path for already-open incidents/alerts is
+         * likewise untouched. Zero queries when the monitor has no
+         * dependencies configured.
+         */
+        const dependencySuppression: DependencySuppressionResult =
+          await MonitorDependencySuppression.getDependencySuppression({
+            monitor: monitor,
+          });
+
         /*
          * Freeze the Monitor Summary as it stands right now, before any
          * incident or alert is created from it. Both creators store the
@@ -945,6 +979,7 @@ export default class MonitorResourceUtil {
           },
           matchesPerSeries: response.perSeriesMatches,
           suppressedSeriesFingerprints,
+          dependencySuppression,
           /*
            * Incoming-request grouping is event-driven: a webhook describes
            * only the keys in its payload, so absence from this tick is not
@@ -969,6 +1004,7 @@ export default class MonitorResourceUtil {
           },
           matchesPerSeries: response.perSeriesMatches,
           suppressedSeriesFingerprints,
+          dependencySuppression,
           /*
            * Incoming-request grouping is event-driven (see the incident
            * create call above): skip the snapshot absence-resolve pass for