Merge pull request #639 from Hritik14/bugfix

Make sure fixed purl is optional in Inference

Author: Hritik14

vulnerabilities/improve_runner.py

@@ -86,14 +86,15 @@ def process_inferences(inferences: List[Inference], advisory: Advisory, improver
                 fix=False,
             ).update_or_create()
 
-        fixed_package, _ = _get_or_create_package(inference.fixed_purl)
-        models.PackageRelatedVulnerability(
-            vulnerability=vuln,
-            package=fixed_package,
-            created_by=improver_name,
-            confidence=inference.confidence,
-            fix=True,
-        ).update_or_create()
+        if inference.fixed_purl:
+            fixed_package, _ = _get_or_create_package(inference.fixed_purl)
+            models.PackageRelatedVulnerability(
+                vulnerability=vuln,
+                package=fixed_package,
+                created_by=improver_name,
+                confidence=inference.confidence,
+                fix=True,
+            ).update_or_create()
 
     advisory.date_improved = datetime.now(timezone.utc)
     advisory.save()

vulnerabilities/improver.py

@@ -31,7 +31,7 @@ class Inference:
     confidence: int = MAX_CONFIDENCE
     summary: Optional[str] = None
     affected_purls: List[PackageURL] = dataclasses.field(default_factory=list)
-    fixed_purl: PackageURL = dataclasses.field(default_factory=list)
+    fixed_purl: PackageURL = None
     references: List[Reference] = dataclasses.field(default_factory=list)
 
     def __post_init__(self):
@@ -49,7 +49,7 @@ def __post_init__(self):
 
         versionless_purls = []
         for purl in self.affected_purls + [self.fixed_purl]:
-            if not purl.version:
+            if purl and not purl.version:
                 versionless_purls.append(purl)
 
         assert (