Filtering by "Vulnerable software" on the Host Software page and then changing the dropdown to "Available for install" returns incorrect results

[jmwatts]

Fleet version: 4.67.0

Web browser and operating system: n/a

---

💥  Actual behavior

Only software with vulnerabilities is shown, but this software is not "Available for install"

🧑‍💻  Steps to reproduce

1. On the host >> software page, add the filter for "Vulnerable software"
2. Change the dropdown from "All software" to "Available for install"

🕯️ Expected results

Only software that has associated vulnerabilities and is also available for install shows in the list.
In this environment, there is only one software title available for install and it does not have any vulnerabilities associated with it, so no software should be shown.

[mikermcneil]

@jmwatts fyi possibly (maybe?) related to #28213

[jmwatts]

Thanks for the heads up @mikermcneil I'm checking to see if it's that way in 4.66 as well. Will update that ticket with ~released-bug or ~unreleased-bug when I find out

[mostlikelee]

Hey team! Please add your planning poker estimate with Zenhub @iansltx @jahzielv @ksykulev

[ksykulev]

What do we expect to see if the software has not been installed on the host, however, there exists a software installer that is available to be installed on the host (team/platform compatibility), but we are filtering for vulnerable software?

[jmwatts]

What do we expect to see if the software has not been installed on the host, however, there exists a software installer that is available to be installed on the host (team/platform compatibility), but we are filtering for vulnerable software?

@ksykulev
If the software has not been installed on the host, however, there exists a software installer that is available to be installed on the host (team/platform compatibility), but we are filtering for vulnerable software - that software installer SHOULD NOT appear in the list, because it has not been installed on the host, and therefore does not have an installed version reported, and therefore does not have an associated vulnerability.