From 0f97a101bdac6c842752c77ee8ba0f20ece9516a Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Thu, 30 Jul 2026 18:07:03 +0530 Subject: [PATCH 1/2] fix: properly serialize severity date Signed-off-by: Keshav Priyadarshi --- vulnerabilities/pipes/export.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vulnerabilities/pipes/export.py b/vulnerabilities/pipes/export.py index 890d3b520..463f98057 100644 --- a/vulnerabilities/pipes/export.py +++ b/vulnerabilities/pipes/export.py @@ -108,7 +108,7 @@ def serialize_severity(sev): "score": sev.value, "scoring_system": sev.scoring_system, "scoring_elements": sev.scoring_elements, - "published_at": str(sev.published_at), + "published_at": str(sev.published_at) if sev.published_at else None, "url": sev.url, } From 492e165a1ef1a1b7c80d6013d307c876c3a9bd44 Mon Sep 17 00:00:00 2001 From: Keshav Priyadarshi Date: Thu, 30 Jul 2026 18:12:38 +0530 Subject: [PATCH 2/2] feat: add schema for federated advisory data resolves: https://github.com/aboutcode-org/federatedcode/issues/67 Signed-off-by: Keshav Priyadarshi --- docs/source/advisory-schema.rst | 12 + docs/source/index.rst | 1 + .../vulnerablecode-advisory.schema-0.1.json | 205 ++++++++++++++++++ vulnerabilities/pipes/export.py | 5 +- 4 files changed, 222 insertions(+), 1 deletion(-) create mode 100644 docs/source/advisory-schema.rst create mode 100644 docs/source/schemas/vulnerablecode-advisory.schema-0.1.json diff --git a/docs/source/advisory-schema.rst b/docs/source/advisory-schema.rst new file mode 100644 index 000000000..433daf3fb --- /dev/null +++ b/docs/source/advisory-schema.rst @@ -0,0 +1,12 @@ +.. _advisory_schema: + +VulnerableCode Advisory Schema +============================== + +Below is the JSON schema for advisories federated by the +``federate_vulnerabilities_v2`` pipeline. + +You can also download the schema `here `_. + +.. literalinclude:: schemas/vulnerablecode-advisory.schema-0.1.json + :language: json diff --git a/docs/source/index.rst b/docs/source/index.rst index 30831c4bf..eb80b4eca 100644 --- a/docs/source/index.rst +++ b/docs/source/index.rst @@ -110,6 +110,7 @@ Reference documentation for VulnerableCode features and customizations. - :ref:`command_line_interface` - :ref:`importers_link` - :ref:`pipeline_avid_mapping` +- :ref:`advisory_schema` .. rst-class:: column column2 bottom-right diff --git a/docs/source/schemas/vulnerablecode-advisory.schema-0.1.json b/docs/source/schemas/vulnerablecode-advisory.schema-0.1.json new file mode 100644 index 000000000..cdd9f5508 --- /dev/null +++ b/docs/source/schemas/vulnerablecode-advisory.schema-0.1.json @@ -0,0 +1,205 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "$id": "https://raw.githubusercontent.com/aboutcode-org/vulnerablecode/refs/heads/main/docs/source/schemas/vulnerablecode-advisory.schema-0.1.json", + "title": "AdvisoryDataV2", + "version": "0.1", + "type": "object", + "definitions": { + "AffectedPackageV2": { + "description": "Relate a Package-URL with a range of affected versions and fixed versions.", + "properties": { + "purl": { + "title": "Base Package-URL", + "type": "string", + "description": "Package-URL (PURL) identifying the base package. Ref: https://www.packageurl.org/docs/purl/specification" + }, + "affected_versions": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Affected VERS Version Range", + "description": "VERS range describing affected package versions. Ref: https://www.packageurl.org/docs/vers/specification" + }, + "fixed_versions": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Fixed VERS Version Range", + "description": "VERS range describing fixed package versions. Ref: https://www.packageurl.org/docs/vers/specification" + }, + "introduced_in_commits": { + "items": { + "$ref": "#/definitions/PackageCommitPatchData" + }, + "title": "Introduced By Commit Patches", + "type": "array" + }, + "fixed_in_commits": { + "items": { + "$ref": "#/definitions/PackageCommitPatchData" + }, + "title": "Fixed By Commit Patches", + "type": "array" + } + }, + "required": [ + "package" + ], + "title": "AffectedPackageV2", + "type": "object" + }, + "PackageCommitPatchData": { + "properties": { + "vcs_url": { + "title": "VCS URL", + "type": "string" + }, + "commit_hash": { + "title": "Commit Hash", + "type": "string" + } + }, + "required": [ + "vcs_url", + "commit_hash" + ], + "title": "PackageCommitPatchData", + "type": "object" + }, + "ReferenceV2": { + "properties": { + "reference_id": { + "default": "", + "title": "Reference ID", + "type": "string" + }, + "reference_type": { + "default": "", + "title": "Reference Type", + "type": "string" + }, + "url": { + "default": "", + "title": "Reference URL", + "type": "string" + } + }, + "title": "ReferenceV2", + "type": "object" + }, + "VulnerabilitySeverity": { + "properties": { + "scoring_system": { + "title": "System", + "type": "string" + }, + "score": { + "title": "Value", + "type": "string" + }, + "scoring_elements": { + "default": "", + "title": "Scoring Elements", + "type": "string" + }, + "published_at": { + "anyOf": [ + { + "format": "date-time", + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Published At" + }, + "url": { + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "title": "Url" + } + }, + "title": "VulnerabilitySeverity", + "type": "object" + } + }, + "description": "Schema to describe a VulnerableCode Advisory.", + "properties": { + "advisory_id": { + "default": "", + "title": "Advisory ID", + "type": "string" + }, + "datasource_id": { + "default": "", + "title": "DataSource ID", + "type": "string" + }, + "datasource_url": { + "default": "", + "title": "DataSource URL", + "type": "string" + }, + "aliases": { + "items": { + "type": "string" + }, + "title": "Aliases", + "type": "array" + }, + "summary": { + "default": "", + "title": "Summary", + "type": "string" + }, + "impacted_packages": { + "items": { + "$ref": "#/definitions/AffectedPackageV2" + }, + "title": "Affected Packages", + "type": "array" + }, + "references": { + "items": { + "$ref": "#/definitions/ReferenceV2" + }, + "title": "References", + "type": "array" + }, + "weaknesses": { + "items": { + "type": "string" + }, + "title": "Weaknesses", + "type": "array" + }, + "severities": { + "items": { + "$ref": "#/definitions/VulnerabilitySeverity" + }, + "title": "Severities", + "type": "array" + } + } +} diff --git a/vulnerabilities/pipes/export.py b/vulnerabilities/pipes/export.py index 463f98057..506e32b51 100644 --- a/vulnerabilities/pipes/export.py +++ b/vulnerabilities/pipes/export.py @@ -13,9 +13,12 @@ from vulnerabilities.models import ImpactedPackage from vulnerabilities.models import ImpactedPackageAffecting from vulnerabilities.models import ImpactedPackageFixedBy -from vulnerabilities.models import PackageCommitPatch from vulnerabilities.models import PackageV2 +# Warning! +# Any changes to the structure of the advisory exporter also require updating the advisory +# schema documentation at `docs/source/advisory-schema.rst`. + def package_prefetched_qs(checkpoint): count = None