add ssvc_trees field

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

docs/reference-vulnerability-management.rst

@@ -118,7 +118,7 @@ vulnerabilities. Each field captures specific aspects of a vulnerability, enabli
 accurate assessment and management. Below is a description of the key fields:
 
 - **advisory_id**:
-  A unique identifier for the vulnerability. For example, **"VCID-2024-0001"**.
+  A unique identifier for the vulnerability. For example, **"PYSEC-2020-2233"**.
 
 - **resource_url**:
   The URL of the data source providing details about the vulnerability.

vulnerabilities/api.py

@@ -46,6 +46,7 @@ class Meta:
             "risk_score",
             "risk_level",
             "fixed_packages",
+            "ssvc_trees",
             "affected_packages",
             "affected_products",
         )

vulnerabilities/migrations/0009_add_ssvc_trees.py

@@ -0,0 +1,19 @@
+# Generated by Django 6.0.6 on 2026-06-15 12:28
+
+import dje.fields
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('vulnerabilities', '0008_purge_and_add_advisory_fields'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='vulnerability',
+            name='ssvc_trees',
+            field=dje.fields.JSONListField(blank=True, default=list, help_text='A list of SSVC decision trees for this vulnerability.'),
+        ),
+    ]

vulnerabilities/models.py

@@ -130,6 +130,10 @@ class Vulnerability(HistoryDateFieldsMixin, DataspacedModel):
         output_field=models.IntegerField(),
         db_persist=True,
     )
+    ssvc_trees = JSONListField(
+        blank=True,
+        help_text=_("A list of SSVC decision trees for this vulnerability."),
+    )
     EXPLOITABILITY_CHOICES = [
         (0.5, _("No exploits known")),
         (1.0, _("Potential exploits")),