Report new/changed vulnerabilities for a package

[pombredanne]

From a private communication:

Is there a way to know that the number of vulnerabilities have changed for a given package so that someone can pull the delta information only (like only for PURLs that have been recently updated) instead of pulling all information every time?

[Hritik14]

New/changed vulnerabilities of a given package imply existence of knowledge of the said given package. If the user could supply the initial and the final purl themselves, we could find and report back with the delta.
The scenario (A) will be something like

Query VC for delta: initial purl, final purl
At VC: Fetch set of vulnerabilites for final purl and subtract if from initial purl

Another scenario (B) would be where user queries with purl_1 and later with purl_2 (with possibly different versions) and wants the diff in the second request. Something like

Query VC with purl_1
VC replies with vulnerabilites_1
Query VC with purl_2 diff
VC somehow figures out purl_2 is related to purl_1 and returns the diff. 

This would require to store some kind of state (ie knowledge of purl_1 queried earlier) and also a way to figure out purl_2 can be diff-ed against purl_1 (it can be done if version is different, cannot be done if package itself is different)

I suppose we want the scenario A, please correct me if not so @pombredanne