wrt. https://github.com/aboutcode-org/vulnerablecode/issues/1572#issuecomment-2475578554
... I think we need something a bit different.
We have this today:
"packages": [
{
"purl": "pkg:pypi/accesscontrol@4.0",
"affected_by_vulnerabilities": [
"VCID-486n-st7z-zqhz"
],
"fixing_vulnerabilities": [],
"next_non_vulnerable_version": "4.3",
"latest_non_vulnerable_version": "5.2"
}
]
Are we missing a "fixed by" that is just for a vulnerability-package?
May be something like that?
"packages": [
{
"purl": "pkg:pypi/accesscontrol@4.0",
"affected_by_vulnerabilities": [
{
"vulnerability_id": "VCID-486n-st7z-zqhz",
"fixed_by_package": "pkg:pypi/accesscontrol@4.1",
}
],
"fixing_vulnerabilities": [],
"next_non_vulnerable_package": "4.3",
"latest_non_vulnerable_package": "5.2"
}
]
with these definitions:
- fixed_by_package: a PURL for the first version that is fixing just one vulnerability
- next_non_vulnerable_package: a PURL for the first version that is non vulnerable to any vulnerability
- latest_non_vulnerable_package: a PURL for the latest version that is non vulnerable to any vulnerability
Question: would this reintroduce nesting?
Originally posted by @pombredanne in #1572 (comment)
... I think we need something a bit different.
We have this today:
Are we missing a "fixed by" that is just for a vulnerability-package?
May be something like that?
with these definitions:
Question: would this reintroduce nesting?
Originally posted by @pombredanne in #1572 (comment)