Merge pull request #2335 from aboutcode-org/correct_logic_for_non_vuln_versions

Correct logic for non vuln versions

Author: TG1999

vulnerabilities/models.py

@@ -3583,9 +3583,6 @@ def bulk_get_or_create_from_purls(self, purls: List[Union[PackageURL, str]]):
     def only_vulnerable(self):
         return self._vulnerable()
 
-    def only_non_vulnerable(self):
-        return self._not_vulnerable().filter(is_ghost=False)
-
     def for_purl(self, purl):
         """
         Return a queryset matching the ``purl`` Package URL.
@@ -3624,20 +3621,6 @@ def with_is_vulnerable(self):
             )
         )
 
-    def with_is_not_vulnerable(self):
-        """
-        Annotate Package with ``is_not_vulnerable`` boolean attribute.
-        """
-        return self.annotate(
-            is_not_vulnerable=Exists(
-                ImpactedPackageFixedBy.objects.filter(
-                    package__pk=OuterRef("pk"),
-                    impacted_package__advisory__is_latest=True,
-                    impacted_package__advisory___all_impacts_unfurled_at__isnull=False,
-                )
-            )
-        )
-
     def all_vulnerable(self):
         latest_unfurled_impacts = ImpactedPackageAffecting.objects.filter(
             package_id=OuterRef("pk"),
@@ -3790,9 +3773,25 @@ def get_non_vulnerable_versions(self):
         if self.version_rank == 0:
             self.calculate_version_rank
 
+        evaluated = Exists(
+            ImpactedPackageFixedBy.objects.filter(
+                package_id=OuterRef("pk"),
+                impacted_package__advisory__is_latest=True,
+                impacted_package__advisory___all_impacts_unfurled_at__isnull=False,
+            )
+        )
+        vulnerable = Exists(
+            ImpactedPackageAffecting.objects.filter(
+                package_id=OuterRef("pk"),
+                impacted_package__advisory__is_latest=True,
+                impacted_package__advisory___all_impacts_unfurled_at__isnull=False,
+            )
+        )
+
         qs = (
             PackageV2.objects.get_fixed_by_package_versions(self, fix=False)
-            .only_non_vulnerable()
+            .annotate(evaluated=evaluated, vulnerable=vulnerable)
+            .filter(evaluated=True, vulnerable=False, is_ghost=False)
             .filter(version_rank__gt=self.version_rank)
             .order_by("version_rank")
         )