optimie creation

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

vulnerabilities/fetch.py

@@ -82,6 +82,8 @@ def fetch_for_packages(
         return results
 
     vulnerablecode = VulnerableCode(dataspace)
+    # Tracks advisory_uids created during this run to avoid re-updating them in later batches.
+    created_advisory_uids = set()
 
     for index, batch in enumerate(chunked_queryset(queryset, batch_size), start=1):
         batch_start = timer()
@@ -122,6 +124,7 @@ def fetch_for_packages(
                 update,
                 batch_results,
                 vulnerability_cache,
+                created_advisory_uids,
                 log_func,
                 verbosity,
             )
@@ -174,7 +177,15 @@ def batch_add_affected(affected_packages, vulnerabilities):
 
 
 def process_vc_entry(
-    vc_entry, queryset, dataspace, update, results, vulnerability_cache, log_func=None, verbosity=1
+    vc_entry,
+    queryset,
+    dataspace,
+    update,
+    results,
+    vulnerability_cache,
+    created_advisory_uids,
+    log_func=None,
+    verbosity=1,
 ):
     """
     Process a single VulnerableCode purl entry: find the matching packages in ``queryset``,
@@ -227,6 +238,7 @@ def process_vc_entry(
             update,
             results,
             vulnerability=vulnerability_cache.get(advisory_uid),
+            created_advisory_uids=created_advisory_uids,
         )
         vulnerability_cache[advisory_uid] = vulnerability
         vulnerabilities.append(vulnerability)
@@ -242,22 +254,29 @@ def process_vc_entry(
 
 
 def create_or_update_vulnerability(
-    vulnerability_data, dataspace, update, results, vulnerability=None
+    vulnerability_data, dataspace, update, results, vulnerability=None, created_advisory_uids=None
 ):
     """
     Create or update a Vulnerability from ``vulnerability_data``.
 
     ``vulnerability`` is the already-resolved instance (looked up from the caller's
     ``vulnerability_cache``), or ``None`` if not yet created. M2M linking is handled
     by the caller via ``batch_add_affected``.
+
+    ``created_advisory_uids`` is a run-wide set of advisory_uids created during this fetch.
+    Vulnerabilities in this set are skipped for updates to avoid spurious re-updates when the
+    same advisory appears in multiple packages across different batches.
     """
+    advisory_uid = vulnerability_data["advisory_uid"]
     if not vulnerability:
         vulnerability = Vulnerability.create_from_data(
             dataspace=dataspace,
             data=vulnerability_data,
         )
         results["created"] += 1
-    elif update:
+        if created_advisory_uids is not None:
+            created_advisory_uids.add(advisory_uid)
+    elif update and advisory_uid not in (created_advisory_uids or ()):
         updated_fields = vulnerability.update_from_data(
             user=None,
             data=vulnerability_data,

vulnerabilities/tests/test_fetch.py

@@ -121,6 +121,40 @@ def test_vulnerabilities_fetch_for_packages(self, mock_bulk_search_by_purl):
         self.assertEqual(Decimal("3.4"), package1.risk_score)
         self.assertEqual(Decimal("1.7"), pp1.weighted_risk_score)
 
+    @mock.patch("dejacode_toolkit.vulnerablecode.VulnerableCode.bulk_search_by_purl")
+    def test_vulnerabilities_fetch_for_packages_cross_batch_no_spurious_update(
+        self, mock_bulk_search_by_purl
+    ):
+        # Two packages affected by the same advisory_uid, processed in separate batches.
+        # The vulnerability must be created once and never "updated" within the same run.
+        make_package(self.dataspace, package_url="pkg:pypi/idna@3.6")
+        make_package(self.dataspace, package_url="pkg:pypi/idna@3.7")
+        queryset = Package.objects.scope(self.dataspace)
+        response_file = self.data / "vulnerabilities" / "idna_3.6_response.json"
+        response_36 = json.loads(response_file.read_text())
+        # Minimal response for idna@3.7: same advisory_uid as idna@3.6's first vulnerability.
+        shared_vuln = response_36["results"][0]["affected_by_vulnerabilities"][0]
+        response_37 = {
+            "count": 1,
+            "next": None,
+            "previous": None,
+            "results": [
+                {
+                    "purl": "pkg:pypi/idna@3.7",
+                    "affected_by_vulnerabilities": [shared_vuln],
+                    "risk_score": 3.4,
+                }
+            ],
+        }
+        mock_bulk_search_by_purl.side_effect = [response_36, response_37]
+
+        results = fetch_for_packages(
+            queryset, self.dataspace, batch_size=1, update=True
+        )
+        # 2 vulnerabilities created from response_36; the shared one is NOT re-updated
+        # when encountered in response_37's batch, because created_advisory_uids guards it.
+        self.assertEqual(results, {"created": 2, "updated": 0})
+
     @mock.patch("vulnerabilities.fetch.find_and_fire_hook")
     def test_vulnerabilities_fetch_notify_vulnerability_data_update(self, mock_fire_hook):
         notify_vulnerability_data_update(self.dataspace)