generate-formula-api: attach vulnerabilities from advisory-database

[andrew]

Attaches a vulnerabilities field to each formula's public API JSON (_data/formula/<name>.json, api/formula/<name>.json) sourced from Homebrew/advisory-database rather than a live OSV.dev query per API build.

Vulns::AdvisoryDatabase is a CachedFeed reader for advisory-database's data/advisories.json (built nightly by rake advisories:concat, Homebrew/advisory-database#30). #status_for(name, pkg_version) evaluates every BREW-* record's ECOSYSTEM range against the given pkg_version via Vulnerability#range_status and returns:

{
  "open": [{"id": "BREW-...", "upstream": ["CVE-..."], "summary": "...", "severity": "high", "fix": null, "fixed_in": null}],
  "patched": [{"id": "BREW-...", "upstream": ["CVE-..."], "fix": "patch", "fixed_in": "6.0_29"}],
  "fixed_count": 3
}

open is records whose range still contains pkg_version; patched is records with ecosystem_specific.fix: "patch" (Homebrew ships a resolves-annotated patch) that pkg_version is past; fixed_count counts bump-fixed records that no longer apply. The key is absent for formulae with no records so consumers can distinguish "checked, clean" from "not covered".

generate-formula-api loads the feed once per build (24h cache TTL) and attaches the field per formula. A feed load failure opoos and the field is omitted so an advisory-database outage does not break the API build.

The internal API (FormulaStruct) and brew info are unchanged; those read from a fixed-field struct that does not carry this key yet and are a follow-up. formulae.brew.sh rendering is a separate PR to that repository.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

Claude Code assisted with implementation and tests; verified via brew lgtm and full brew style.

---

[Copilot]

Pull request overview

Adds vulnerability metadata from Homebrew/advisory-database to the public formula API JSON generated by brew generate-formula-api, avoiding per-build live OSV.dev queries.

Changes:

• Introduces Homebrew::Vulns::AdvisoryDatabase as a cached feed reader for data/advisories.json.
• Extends generate-formula-api to attach a per-formula vulnerabilities object (when available) and to gracefully omit it on feed load failure.
• Adds unit tests for the new feed reader and updates the generate-formula-api command spec to cover the new behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
Library/Homebrew/vulns/advisory_database.rb	New cached feed reader + status_for API returning the public JSON shape.
Library/Homebrew/test/vulns/advisory_database_spec.rb	New unit tests for feed validation, record wrapping, and status partitioning.
Library/Homebrew/dev-cmd/generate-formula-api.rb	Loads advisory feed once per run and attaches vulnerabilities into public formula JSON.
Library/Homebrew/test/dev-cmd/generate-formula-api_spec.rb	Updates command spec to cover presence/absence/omission-on-error of vulnerabilities.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MikeMcQuaid]

Thanks!