Merge branch 'main' into Page-Updated

Author: Rishi-source

CHANGELOG.rst

@@ -4,6 +4,18 @@ Release notes
 Version (next)
 -------------------
 
+Version v34.1.0
+-------------------
+
+- Add support for Calculating Package Vulnerability Risk #1593
+- Migrate pysec importer to aboutcode pipeline #1628
+- Fix 500 error in /api/cpes endpoint #1629
+- Add documentation for new pipeline design #1621
+- Segregate PackageRelatedVulnerability model to new models #1612
+- Add GitHub action to publish aboutcode.hashid PyPI #1615
+- Fix vers range crash #1598
+- Use 4-tier system for storing package metadata #1609
+
 
 Version v34.0.2
 -------------------

README.rst

@@ -80,7 +80,7 @@ Then run an importer for nginx advisories (which is small)
 
 .. code:: bash
 
-    docker compose exec vulnerablecode ./manage.py import vulnerabilities.importers.nginx.NginxImporter
+    docker compose exec vulnerablecode ./manage.py import nginx_importer
     docker compose exec vulnerablecode ./manage.py improve --all
 
 At this point, the VulnerableCode app and API should be up and running with
@@ -117,7 +117,7 @@ On a Debian system, use this
     make dev envfile postgres
     make test
     source venv/bin/activate
-    ./manage.py import vulnerabilities.importers.nginx.NginxImporter
+    ./manage.py import nginx_importer
     ./manage.py improve --all
     make run
 

setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = vulnerablecode
-version = 34.0.2
+version = 34.1.0
 license = Apache-2.0 AND CC-BY-SA-4.0
 
 # description must be on ONE line https://github.com/pypa/setuptools/issues/1390

vulnerabilities/migrations/0071_auto_20241007_1044.py

@@ -16,21 +16,28 @@ def split_packagerelatedvulnerability(apps, schema_editor):
         progress_step=1,
         logger=print,
         )
+    fixing_packages = []
+    affected_packages = []
     for prv in progress.iter(obsolete_package_relation_query.iterator(chunk_size=10000)):
         if prv.fix:
-            FixingPackageRelatedVulnerability.objects.create(
+            fp = FixingPackageRelatedVulnerability(
                 package=prv.package,
                 vulnerability=prv.vulnerability,
                 created_by=prv.created_by,
                 confidence=prv.confidence,
             )
+            fixing_packages.append(fp)
         else:
-            AffectedByPackageRelatedVulnerability.objects.create(
+            ap = AffectedByPackageRelatedVulnerability(
                 package=prv.package,
                 vulnerability=prv.vulnerability,
                 created_by=prv.created_by,
                 confidence=prv.confidence,
             )
+            affected_packages.append(ap)
+    
+    FixingPackageRelatedVulnerability.objects.bulk_create(fixing_packages, batch_size=10000)
+    AffectedByPackageRelatedVulnerability.objects.bulk_create(affected_packages, batch_size=10000)
 
 def reverse_migration(apps, schema_editor):
     FixingPackageRelatedVulnerability = apps.get_model('vulnerabilities', 'FixingPackageRelatedVulnerability')

vulnerabilities/migrations/0076_alter_packagechangelog_software_version_and_more.py

@@ -0,0 +1,31 @@
+# Generated by Django 4.2.16 on 2024-11-08 07:38
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0075_package_risk_score"),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name="packagechangelog",
+            name="software_version",
+            field=models.CharField(
+                default="34.1.0",
+                help_text="Version of the software at the time of change",
+                max_length=100,
+            ),
+        ),
+        migrations.AlterField(
+            model_name="vulnerabilitychangelog",
+            name="software_version",
+            field=models.CharField(
+                default="34.1.0",
+                help_text="Version of the software at the time of change",
+                max_length=100,
+            ),
+        ),
+    ]

vulnerablecode/__init__.py

@@ -12,7 +12,7 @@
 import warnings
 from pathlib import Path
 
-__version__ = "34.0.2"
+__version__ = "34.1.0"
 
 
 def command_line():