Display vulnerable version range in the UI and report in the API

[pombredanne]

We should display the vulnerable version range(s) in the UI and report it in the API reported as vers syntax.

There are likely some gremlins in the data model that may prohibit to do so easily just now, so it needs some design

[vaibhav11123]

Hi @pombredanne , I’d like to pick this up.

I checked how version ranges are stored right now — looks like they’re coming through the VersionRange model attached to AffectedByPackageRelatedVulnerability (and sometimes PackageRelatedVulnerability). The data already exists, it’s just not exposed anywhere.

My rough plan:

API (v2):
• Add a vulnerable_ranges field to the serializer.
• Collect all VersionRange entries for the vulnerability.
• Convert each to vers: syntax using univers.
• Return a clean list (deduped, sorted).

UI:
• Add a small section under vulnerability details showing these ranges as simple text lines.

Before I move forward, one clarification:
→ Should I return the raw univers vers: expression (e.g., vers:pypi/>=3.0,<3.1.4), or do you prefer a simpler string format?

If this direction looks okay, I’ll start implementation.

[pombredanne]

@ppkarwasz FYI, this is a bug

[pombredanne]

@vaibhav11123 please go for it. No vibe coding please.