Skip to content

Commit 5426539

Browse files
abhey8abhey8
authored
Merge branch 'main' into codex/issue-1295-package-release-date
2 parents ade9fd3 + 2a08e55 commit 5426539

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+3070
-1147
lines changed

‎.github/workflows/pypi-release.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,3 +85,5 @@ jobs:
8585
- name: Publish to PyPI
8686
if: startsWith(github.ref, 'refs/tags/')
8787
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
88+
with:
89+
verbose: true

‎CHANGELOG.rst‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,25 @@
11
Release notes
22
=============
33

4+
Version v38.3.0
5+
---------------------
6+
7+
- feat: add high priority queue and run version range unfurling pipeline more frequently (https://github.com/aboutcode-org/vulnerablecode/pull/2256)
8+
9+
Version v38.1.0
10+
---------------------
11+
12+
- Throttle UI to 15 requests per minute to avoid abuse and improve performance.
13+
- Handle errors in unfurl_version_range pipeline.
14+
- Remove Todo pipeline from v1 pipelines.
15+
- Add openAPI documentation for Package and Advisory viewset.
16+
17+
Version v38.0.0
18+
---------------------
19+
20+
- This is a major version, we have changed our V3 API, refer to ``api_v3_usage.rst`` for details.
21+
- We have started grouping advisories which have aliases or identifiers in common and also affect same set of packages together.
22+
423
Version v37.0.0
524
---------------------
625

‎PIPELINES-AVID.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
* - project-kb-statements_v2
5656
- Vulnerability ID of the record
5757
* - pypa_importer_v2
58-
- ID of the OSV record
58+
- {package_name}/{ID of the OSV record}
5959
* - pysec_importer_v2
6060
- ID of the OSV record
6161
* - redhat_importer_v2

‎api_v3_usage.rst‎

Lines changed: 254 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,254 @@
1+
Package Endpoint
2+
================
3+
4+
We are migrating from **API v1** to **API v3**.
5+
6+
Previously, the ``/api/packages`` endpoint exposed multiple routes:
7+
8+
- ``bulk_search``
9+
- ``bulk_lookup``
10+
- ``lookup``
11+
- ``all``
12+
13+
In **API v3**, all these capabilities are consolidated into a **single endpoint**:
14+
15+
::
16+
17+
POST /api/v3/packages
18+
19+
20+
Pagination
21+
----------
22+
23+
Responses from the package endpoint are **always paginated**, with **10 results per page**.
24+
25+
Each response includes:
26+
27+
- ``count`` — total number of results
28+
- ``next`` — URL for the next page
29+
- ``previous`` — URL for the previous page
30+
31+
If a package is associated with **more than 100 advisories**, the response will include:
32+
33+
- ``affected_by_vulnerabilities_url`` instead of ``affected_by_vulnerabilities``
34+
- ``fixing_vulnerabilities_url`` instead of ``fixing_vulnerabilities``
35+
36+
37+
Getting All Vulnerable Packages
38+
-------------------------------
39+
40+
Instead of calling ``/api/packages/all``, call the v3 endpoint with an empty ``purls`` list.
41+
42+
::
43+
44+
POST /api/v3/packages
45+
46+
{
47+
"purls": []
48+
}
49+
50+
Example response:
51+
52+
::
53+
54+
{
55+
"count": 596,
56+
"next": "http://example.com/api/v3/packages?page=2",
57+
"previous": null,
58+
"results": [
59+
"pkg:npm/626@1.1.1",
60+
"pkg:npm/aedes@0.35.0",
61+
"pkg:npm/airbrake@0.3.8",
62+
"pkg:npm/angular-http-server@1.4.3",
63+
"pkg:npm/apex-publish-static-files@2.0.0",
64+
"pkg:npm/atob@2.0.3",
65+
"pkg:npm/augustine@0.2.3",
66+
"pkg:npm/backbone@0.3.3",
67+
"pkg:npm/base64-url@1.3.3",
68+
"pkg:npm/base64url@2.0.0"
69+
]
70+
}
71+
72+
73+
Bulk Search (Replacement)
74+
-------------------------
75+
76+
Instead of calling ``/api/packages/bulk_search``, use:
77+
78+
::
79+
80+
POST /api/v3/packages
81+
82+
Parameters:
83+
84+
- ``purls`` — list of package URLs to query
85+
- ``details`` — boolean (default: ``false``)
86+
- ``ignore_qualifiers_subpath`` — boolean (default: ``false``)
87+
88+
The ``ignore_qualifiers_subpath`` flag replaces the previous ``plain_purl`` parameter.
89+
When set to ``true``, qualifiers and subpaths in PURLs are ignored.
90+
91+
92+
Get Only Vulnerable PURLs
93+
~~~~~~~~~~~~~~~~~~~~~~~~~
94+
95+
::
96+
97+
POST /api/v3/packages
98+
99+
{
100+
"purls": ["pkg:npm/atob@2.0.3", "pkg:pypi/sample@2.0.0"],
101+
"details": false
102+
}
103+
104+
Example response:
105+
106+
::
107+
108+
{
109+
"count": 1,
110+
"next": null,
111+
"previous": null,
112+
"results": [
113+
"pkg:npm/atob@2.0.3"
114+
]
115+
}
116+
117+
118+
Get Detailed Vulnerability Information
119+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
120+
121+
::
122+
123+
POST /api/v3/packages
124+
125+
{
126+
"purls": ["pkg:npm/atob@2.0.3", "pkg:pypi/sample@2.0.0"],
127+
"details": true
128+
}
129+
130+
Example response:
131+
132+
::
133+
134+
{
135+
"count": 1,
136+
"next": null,
137+
"previous": null,
138+
"results": [
139+
{
140+
"purl": "pkg:npm/atob@2.0.3",
141+
"affected_by_vulnerabilities": [
142+
{
143+
"advisory_id": "GHSA-g5vw-3h65-2q3v",
144+
"aliases": [],
145+
"weighted_severity": null,
146+
"exploitability_score": null,
147+
"risk_score": null,
148+
"summary": "Access control vulnerable to user data",
149+
"fixed_by_packages": [
150+
"pkg:pypi/accesscontrol@7.2"
151+
],
152+
},
153+
],
154+
"fixing_vulnerabilities": [],
155+
"next_non_vulnerable_version": "2.1.0",
156+
"latest_non_vulnerable_version": "2.1.0",
157+
"risk_score": null
158+
}
159+
]
160+
}
161+
162+
163+
Using Approximate Matching
164+
~~~~~~~~~~~~~~~~~~~~~~~~~~
165+
166+
::
167+
168+
POST /api/v3/packages
169+
170+
{
171+
"purls": ["pkg:npm/atob@2.0.3?foo=bar"],
172+
"ignore_qualifiers_subpath": true,
173+
"details": true
174+
}
175+
176+
Example response:
177+
178+
::
179+
180+
{
181+
"count": 1,
182+
"next": null,
183+
"previous": null,
184+
"results": [
185+
{
186+
"purl": "pkg:npm/atob@2.0.3",
187+
"affected_by_vulnerabilities": [
188+
{
189+
"advisory_id": "GHSA-g5vw-3h65-2q3v",
190+
"aliases": [],
191+
"weighted_severity": null,
192+
"exploitability_score": null,
193+
"risk_score": null,
194+
"summary": "Access control vulnerable to user data",
195+
"fixed_by_packages": [
196+
"pkg:pypi/accesscontrol@7.2"
197+
],
198+
}
199+
],
200+
"fixing_vulnerabilities": [],
201+
"next_non_vulnerable_version": "2.1.0",
202+
"latest_non_vulnerable_version": "2.1.0",
203+
"risk_score": null
204+
}
205+
]
206+
}
207+
208+
209+
Advisory Endpoint
210+
=================
211+
212+
Retrieve advisories for one or more PURLs:
213+
214+
::
215+
216+
POST /api/v3/advisories
217+
218+
{
219+
"purls": ["pkg:npm/atob@2.0.3", "pkg:pypi/sample@2.0.0"]
220+
}
221+
222+
Responses are paginated (10 results per page) and include ``next`` and ``previous`` links.
223+
224+
225+
Affected-By Advisories Endpoint
226+
===============================
227+
228+
Retrieve advisories that **affect (impact)** a given PURL:
229+
230+
::
231+
232+
GET /api/v3/affected-by-advisories?purl=<purl>
233+
234+
Example:
235+
236+
::
237+
238+
GET /api/v3/affected-by-advisories?purl=pkg:npm/atob@2.0.3
239+
240+
241+
Fixing Advisories Endpoint
242+
==========================
243+
244+
Retrieve advisories that are **fixed by** a given PURL:
245+
246+
::
247+
248+
GET /api/v3/fixing-advisories?purl=<purl>
249+
250+
Example:
251+
252+
::
253+
254+
GET /api/v3/fixing-advisories?purl=pkg:npm/atob@2.1.0

‎docker-compose.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,17 @@ services:
5757
- db
5858
- vulnerablecode
5959

60+
vulnerablecode_rqworker_high:
61+
build: .
62+
command: wait-for-it web:8000 -- python ./manage.py rqworker high
63+
env_file:
64+
- docker.env
65+
volumes:
66+
- /etc/vulnerablecode/:/etc/vulnerablecode/
67+
depends_on:
68+
- vulnerablecode_redis
69+
- db
70+
- vulnerablecode
6071

6172
nginx:
6273
image: nginx

‎etc/nginx/conf.d/default.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ server {
1212
proxy_redirect off;
1313
client_max_body_size 10G;
1414
proxy_read_timeout 600s;
15+
proxy_set_header X-Forwarded-Proto $scheme;
16+
proxy_set_header X-Forwarded-Host $host;
1517
}
1618

1719
location /static/ {

‎setup.cfg‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[metadata]
22
name = vulnerablecode
3-
version = 37.0.0
3+
version = 38.3.0
44
license = Apache-2.0 AND CC-BY-SA-4.0
55

66
# description must be on ONE line https://github.com/pypa/setuptools/issues/1390

0 commit comments

Comments
 (0)