Merge branch 'main' into fix-swagger

Author: TG1999

CHANGELOG.rst

@@ -1,6 +1,21 @@
 Release notes
 =============
 
+Version v40.0.1
+---------------------
+
+- Add throttling info in API docs, remove V1 and V2 API docs.
+- Avoid converting None to "None" in AdvisorySeverity.
+- Refine package curation workflow.
+
+
+Version v40.0.0
+---------------------
+
+- Fix malformed CVSS severity scores.
+- Disable v1 API, UI & pipelines.
+
+
 Version v39.0.0
 ---------------------
 

docs/source/conf.py

@@ -42,6 +42,7 @@
     "http://ftp.suse.com/pub/projects/security/yaml/",
     r"https://nixos\.wiki/",  # NixOS wiki blocks CI bots with 403
     "https://usn.ubuntu.com/usn-db/database-all.json.bz2",
+    "https://public.vulnerablecode.io/vulnerabilities/search/",
 ]
 
 # Add any Sphinx extension module names here, as strings. They can be

requirements-dev.txt

@@ -1,3 +1,4 @@
+aboutcode.federated==1.0.3
 aboutcode.pipeline==0.1.0
 alabaster==0.7.16
 altcha==1.0.0

requirements.txt

@@ -1,3 +1,4 @@
+aboutcode.federated==1.0.3
 aboutcode.pipeline==0.1.0
 altcha==1.0.0
 asgiref==3.8.1

setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = vulnerablecode
-version = 39.0.0
+version = 40.0.1
 license = Apache-2.0 AND CC-BY-SA-4.0
 
 # description must be on ONE line https://github.com/pypa/setuptools/issues/1390

vulnerabilities/importer.py

@@ -19,7 +19,6 @@
 from typing import Optional
 from typing import Set
 from typing import Tuple
-from typing import Union
 
 import pytz
 from dateutil import parser as dateparser
@@ -40,7 +39,6 @@
 from vulnerabilities.utils import get_reference_id
 from vulnerabilities.utils import is_commit
 from vulnerabilities.utils import is_cve
-from vulnerabilities.utils import nearest_patched_package
 from vulnerabilities.utils import purl_to_dict
 from vulnerabilities.utils import update_purl_version
 
@@ -65,7 +63,7 @@ def __post_init__(self):
             raise TypeError(f"system must be a ScoringSystem, got {type(self.system)!r}")
 
         if not isinstance(self.value, str):
-            self.value = str(self.value)
+            self.value = str(self.value) if self.value else ""
 
     def to_dict(self):
         data = {

vulnerabilities/importers/__init__.py

@@ -7,38 +7,7 @@
 # See https://aboutcode.org for more information about nexB OSS projects.
 #
 
-from vulnerabilities.importers import apache_httpd
-from vulnerabilities.importers import apache_kafka
-from vulnerabilities.importers import apache_tomcat
-from vulnerabilities.importers import archlinux
-from vulnerabilities.importers import curl
-from vulnerabilities.importers import debian
-from vulnerabilities.importers import debian_oval
-from vulnerabilities.importers import elixir_security
-from vulnerabilities.importers import epss
-from vulnerabilities.importers import fireeye
-from vulnerabilities.importers import gentoo
-from vulnerabilities.importers import github_osv
-from vulnerabilities.importers import istio
-from vulnerabilities.importers import mozilla
-from vulnerabilities.importers import oss_fuzz
-from vulnerabilities.importers import postgresql
-from vulnerabilities.importers import project_kb_msr2019
-from vulnerabilities.importers import redhat
-from vulnerabilities.importers import retiredotnet
-from vulnerabilities.importers import ruby
-from vulnerabilities.importers import suse_scores
-from vulnerabilities.importers import ubuntu_usn
-from vulnerabilities.importers import vulnrichment
-from vulnerabilities.importers import xen
 from vulnerabilities.pipelines import VulnerableCodeBaseImporterPipelineV2
-from vulnerabilities.pipelines import alpine_linux_importer
-from vulnerabilities.pipelines import github_importer
-from vulnerabilities.pipelines import gitlab_importer
-from vulnerabilities.pipelines import nginx_importer
-from vulnerabilities.pipelines import npm_importer
-from vulnerabilities.pipelines import pypa_importer
-from vulnerabilities.pipelines import pysec_importer
 from vulnerabilities.pipelines.v2_importers import alpine_linux_importer as alpine_linux_importer_v2
 from vulnerabilities.pipelines.v2_importers import aosp_importer as aosp_importer_v2
 from vulnerabilities.pipelines.v2_importers import apache_httpd_importer as apache_httpd_v2
@@ -159,37 +128,6 @@
         collect_fix_commits_v2.CollectGitFixCommitsPipeline,
         collect_fix_commits_v2.CollectJenkinsFixCommitsPipeline,
         collect_fix_commits_v2.CollectGitlabFixCommitsPipeline,
-        github_importer.GitHubAPIImporterPipeline,
-        gitlab_importer.GitLabImporterPipeline,
-        github_osv.GithubOSVImporter,
-        pypa_importer.PyPaImporterPipeline,
-        npm_importer.NpmImporterPipeline,
-        nginx_importer.NginxImporterPipeline,
-        pysec_importer.PyPIImporterPipeline,
-        apache_tomcat.ApacheTomcatImporter,
-        postgresql.PostgreSQLImporter,
-        debian.DebianImporter,
-        curl.CurlImporter,
-        epss.EPSSImporter,
-        vulnrichment.VulnrichImporter,
-        alpine_linux_importer.AlpineLinuxImporterPipeline,
-        apache_kafka.ApacheKafkaImporter,
-        ruby.RubyImporter,
-        redhat.RedhatImporter,
-        archlinux.ArchlinuxImporter,
-        debian_oval.DebianOvalImporter,
-        retiredotnet.RetireDotnetImporter,
-        apache_httpd.ApacheHTTPDImporter,
-        mozilla.MozillaImporter,
-        gentoo.GentooImporter,
-        istio.IstioImporter,
-        project_kb_msr2019.ProjectKBMSRImporter,
-        suse_scores.SUSESeverityScoreImporter,
-        elixir_security.ElixirSecurityImporter,
-        xen.XenImporter,
-        ubuntu_usn.UbuntuUSNImporter,
-        fireeye.FireyeImporter,
-        oss_fuzz.OSSFuzzImporter,
     ]
 )
 

vulnerabilities/improvers/__init__.py

@@ -7,15 +7,6 @@
 # See https://aboutcode.org for more information about nexB OSS projects.
 #
 
-from vulnerabilities.improvers import valid_versions
-from vulnerabilities.improvers import vulnerability_status
-from vulnerabilities.pipelines import compute_package_risk
-from vulnerabilities.pipelines import compute_package_version_rank
-from vulnerabilities.pipelines import enhance_with_exploitdb
-from vulnerabilities.pipelines import enhance_with_kev
-from vulnerabilities.pipelines import enhance_with_metasploit
-from vulnerabilities.pipelines import flag_ghost_packages
-from vulnerabilities.pipelines import populate_vulnerability_summary_pipeline
 from vulnerabilities.pipelines.v2_improvers import archive_urls
 from vulnerabilities.pipelines.v2_improvers import collect_ssvc_trees
 from vulnerabilities.pipelines.v2_improvers import compute_advisory_todo as compute_advisory_todo_v2
@@ -51,29 +42,6 @@
         reference_collect_commits.CollectReferencesFixCommitsPipeline,
         enhance_with_github_poc.GithubPocsImproverPipeline,
         mark_unfurl_version_range.MarkUnfurlVersionRangePipeline,
-        valid_versions.GitHubBasicImprover,
-        valid_versions.GitLabBasicImprover,
-        valid_versions.NginxBasicImprover,
-        valid_versions.ApacheHTTPDImprover,
-        valid_versions.DebianBasicImprover,
-        valid_versions.NpmImprover,
-        valid_versions.ElixirImprover,
-        valid_versions.ApacheTomcatImprover,
-        valid_versions.ApacheKafkaImprover,
-        valid_versions.IstioImprover,
-        valid_versions.DebianOvalImprover,
-        valid_versions.OSSFuzzImprover,
-        valid_versions.RubyImprover,
-        valid_versions.GithubOSVImprover,
-        vulnerability_status.VulnerabilityStatusImprover,
-        valid_versions.CurlImprover,
-        flag_ghost_packages.FlagGhostPackagePipeline,
-        enhance_with_kev.VulnerabilityKevPipeline,
-        enhance_with_metasploit.MetasploitImproverPipeline,
-        enhance_with_exploitdb.ExploitDBImproverPipeline,
-        compute_package_risk.ComputePackageRiskPipeline,
-        compute_package_version_rank.ComputeVersionRankPipeline,
-        populate_vulnerability_summary_pipeline.PopulateVulnerabilitySummariesPipeline,
         group_advisories_for_packages_v2.GroupAdvisoriesForPackages,
     ]
 )

vulnerabilities/middleware/altcha_protection.py

@@ -17,7 +17,6 @@
 
 ALTCHA_PROTECTED_PREFIXES = (
     "/packages/",
-    "/vulnerabilities/",
     "/advisories/",
     "/affected-by-advisories/v2/",
     "/fixing-advisories/v2/",

vulnerabilities/migrations/0138_fix_malformed_cvss_vector.py

@@ -0,0 +1,41 @@
+# Generated by Django 5.2.11 on 2026-06-30 08:15
+
+from django.db import migrations
+from django.db.models import Value
+from django.db.models.functions import Concat
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0137_alter_pipelineschedule_run_interval"),
+    ]
+
+    def fix_malformed_cvss_severity(apps, schema_editor):
+        AdvisorySeverity = apps.get_model("vulnerabilities", "AdvisorySeverity")
+
+        AdvisorySeverity.objects.filter(
+            scoring_system="cvssv3.1",
+            scoring_elements__startswith="CVSS:3.0/",
+        ).update(scoring_system="cvssv3")
+
+        AdvisorySeverity.objects.filter(
+            scoring_system="cvssv3",
+            scoring_elements__isnull=False,
+        ).exclude(
+            scoring_elements="",
+        ).exclude(
+            scoring_elements__startswith="CVSS:3.0/",
+        ).update(
+            scoring_elements=Concat(
+                Value("CVSS:3.0/"),
+                "scoring_elements",
+            )
+        )
+
+    operations = [
+        migrations.RunPython(
+            fix_malformed_cvss_severity,
+            reverse_code=migrations.RunPython.noop,
+        ),
+    ]