Remove is_latest from ImpactedPackage

Signed-off-by: Tushar Goel <tushar.goel.dav@gmail.com>

Author: TG1999

CHANGELOG.rst

@@ -5,9 +5,10 @@ next release
 ---------------------
 
 - WARNING: Vulnerablecode V1 API and UI has stopped supporting Ubuntu OVAL advisories, please shift to V3 API for new Ubuntu advisories.
-- WARNING: We will deprecate improver pipelines for calculating package version rank, grouping advisories for packages and calculating risk scores in the next release, we are doing it at advisory import time instead of as separate pipelines, this will improve the performance and consistency of the data.
+- WARNING: We will deprecate improver pipelines for calculating package version rank and grouping advisories for packages in the next release, we are doing it at advisory import time instead of as separate pipelines, this will improve the performance and consistency of the data.
 - Calculate package verion rank, group advisories for packages and package risk score and advisory risk score during import of advisories.
-- Add attribute ``pipeline_id`` to AdvisoryV2 to track the pipeline that created the advisory, also rename existing ``datasource_id`` and AVIDs. 
+- Add attribute ``pipeline_id`` to AdvisoryV2 to track the pipeline that created the advisory, also rename existing ``datasource_id`` and AVIDs.
+
 
 Version v38.6.0
 ---------------------

vulnerabilities/api_v3.py

@@ -721,7 +721,7 @@ def get_impacts_bulk(packages):
 
     impacts = (
         ImpactedPackageAffecting.objects.filter(
-            package_id__in=package_ids, impacted_package__is_latest=True
+            package_id__in=package_ids, impacted_package__advisory__is_latest=True
         )
         .select_related("impacted_package__advisory")
         .prefetch_related(

vulnerabilities/improvers/__init__.py

@@ -9,21 +9,17 @@
 
 from vulnerabilities.improvers import valid_versions
 from vulnerabilities.improvers import vulnerability_status
-from vulnerabilities.pipelines import add_cvss31_to_CVEs
 from vulnerabilities.pipelines import compute_package_risk
+from vulnerabilities.pipelines import compute_package_version_rank
 from vulnerabilities.pipelines import enhance_with_exploitdb
 from vulnerabilities.pipelines import enhance_with_kev
 from vulnerabilities.pipelines import enhance_with_metasploit
 from vulnerabilities.pipelines import flag_ghost_packages
 from vulnerabilities.pipelines import populate_vulnerability_summary_pipeline
-from vulnerabilities.pipelines import remove_duplicate_advisories
 from vulnerabilities.pipelines.v2_improvers import archive_urls
 from vulnerabilities.pipelines.v2_improvers import collect_ssvc_trees
 from vulnerabilities.pipelines.v2_improvers import compute_advisory_todo as compute_advisory_todo_v2
 from vulnerabilities.pipelines.v2_improvers import compute_package_risk as compute_package_risk_v2
-from vulnerabilities.pipelines.v2_improvers import (
-    computer_package_version_rank as compute_version_rank_v2,
-)
 from vulnerabilities.pipelines.v2_improvers import enhance_with_exploitdb as exploitdb_v2
 from vulnerabilities.pipelines.v2_improvers import enhance_with_github_poc
 from vulnerabilities.pipelines.v2_improvers import enhance_with_kev as enhance_with_kev_v2
@@ -59,15 +55,13 @@
         enhance_with_metasploit.MetasploitImproverPipeline,
         enhance_with_exploitdb.ExploitDBImproverPipeline,
         compute_package_risk.ComputePackageRiskPipeline,
-        add_cvss31_to_CVEs.CVEAdvisoryMappingPipeline,
-        remove_duplicate_advisories.RemoveDuplicateAdvisoriesPipeline,
+        compute_package_version_rank.ComputeVersionRankPipeline,
         populate_vulnerability_summary_pipeline.PopulateVulnerabilitySummariesPipeline,
         exploitdb_v2.ExploitDBImproverPipeline,
         enhance_with_kev_v2.VulnerabilityKevPipeline,
         flag_ghost_packages_v2.FlagGhostPackagePipeline,
         enhance_with_metasploit_v2.MetasploitImproverPipeline,
         compute_package_risk_v2.ComputePackageRiskPipeline,
-        compute_version_rank_v2.ComputeVersionRankPipeline,
         unfurl_version_range_v2.UnfurlVersionRangePipeline,
         collect_ssvc_trees.CollectSSVCPipeline,
         relate_severities.RelateSeveritiesPipeline,

…ations/0135_impactedpackage_is_latest.py …0135_advisoryv2__all_impacts_unfurled.pyvulnerabilities/migrations/0135_impactedpackage_is_latest.py renamed to vulnerabilities/migrations/0135_advisoryv2__all_impacts_unfurled.py vulnerabilities/migrations/0135_impactedpackage_is_latest.py renamed to vulnerabilities/migrations/0135_advisoryv2__all_impacts_unfurled.py

@@ -1,4 +1,4 @@
-# Generated by Django 5.2.11 on 2026-05-30 17:49
+# Generated by Django 5.2.11 on 2026-06-01 10:56
 
 from django.db import migrations, models
 
@@ -11,12 +11,11 @@ class Migration(migrations.Migration):
 
     operations = [
         migrations.AddField(
-            model_name="impactedpackage",
-            name="is_latest",
+            model_name="advisoryv2",
+            name="_all_impacts_unfurled",
             field=models.BooleanField(
-                db_index=True,
                 default=False,
-                help_text="Indicates whether this is the latest impact for the advisory.",
+                help_text="Indicates whether all impacts for this advisory have been unfurled.",
             ),
         ),
     ]

vulnerabilities/migrations/0136_populate_impactedpackage_is_latest.py

@@ -2935,14 +2935,14 @@ def latest_for_avids(self, avids):
 
     def latest_affecting_advisories_for_purl(self, purl):
         adv_ids = ImpactedPackage.objects.filter(
-            affecting_packages__package_url=purl, is_latest=True
+            affecting_packages__package_url=purl, advisory__is_latest=True
         ).values_list("advisory_id", flat=True)
 
         return self.filter(id__in=Subquery(adv_ids)).latest_per_avid()
 
     def latest_affecting_advisories_for_purls(self, purls):
         adv_ids = ImpactedPackage.objects.filter(
-            affecting_packages__package_url__in=purls, is_latest=True
+            affecting_packages__package_url__in=purls, advisory__is_latest=True
         ).values_list(
             "advisory_id",
             flat=True,
@@ -2951,7 +2951,7 @@ def latest_affecting_advisories_for_purls(self, purls):
 
     def latest_affecting_advisories_for_packages(self, packages):
         adv_ids = ImpactedPackage.objects.filter(
-            affecting_packages__in=packages, is_latest=True
+            affecting_packages__in=packages, advisory__is_latest=True
         ).values_list(
             "advisory_id",
             flat=True,
@@ -2960,7 +2960,7 @@ def latest_affecting_advisories_for_packages(self, packages):
 
     def latest_fixed_by_advisories_for_purl(self, purl):
         adv_ids = ImpactedPackage.objects.filter(
-            fixed_by_packages__package_url=purl, is_latest=True
+            fixed_by_packages__package_url=purl, advisory__is_latest=True
         ).values_list(
             "advisory_id",
             flat=True,
@@ -2969,7 +2969,7 @@ def latest_fixed_by_advisories_for_purl(self, purl):
 
     def latest_fixed_by_advisories_for_purls(self, purls):
         adv_ids = ImpactedPackage.objects.filter(
-            fixed_by_packages__package_url__in=purls, is_latest=True
+            fixed_by_packages__package_url__in=purls, advisory__is_latest=True
         ).values_list(
             "advisory_id",
             flat=True,
@@ -2980,15 +2980,15 @@ def latest_fixed_by_advisories_for_purls(self, purls):
     def latest_advisories_for_purls(self, purls):
         adv_ids = (
             ImpactedPackage.objects.filter(
-                affecting_packages__package_url__in=purls, is_latest=True
+                affecting_packages__package_url__in=purls, advisory__is_latest=True
             )
             .values_list(
                 "advisory_id",
                 flat=True,
             )
             .union(
                 ImpactedPackage.objects.filter(
-                    fixed_by_packages__package_url__in=purls, is_latest=True
+                    fixed_by_packages__package_url__in=purls, advisory__is_latest=True
                 ).values_list(
                     "advisory_id",
                     flat=True,
@@ -3001,14 +3001,16 @@ def latest_advisories_for_purls(self, purls):
 
     def latest_advisories_for_purl(self, purl):
         adv_ids = (
-            ImpactedPackage.objects.filter(affecting_packages__package_url=purl, is_latest=True)
+            ImpactedPackage.objects.filter(
+                affecting_packages__package_url=purl, advisory__is_latest=True
+            )
             .values_list(
                 "advisory_id",
                 flat=True,
             )
             .union(
                 ImpactedPackage.objects.filter(
-                    fixed_by_packages__package_url=purl, is_latest=True
+                    fixed_by_packages__package_url=purl, advisory__is_latest=True
                 ).values_list(
                     "advisory_id",
                     flat=True,
@@ -3221,6 +3223,11 @@ class AdvisoryV2(models.Model):
         help_text="Risk expressed as a number ranging from 0 to 10. Risk is calculated from weighted severity and exploitability values. It is the maximum value of (the weighted severity multiplied by its exploitability) or 10. Risk = min(weighted severity * exploitability, 10)",
     )
 
+    _all_impacts_unfurled = models.BooleanField(
+        default=False,
+        help_text="Indicates whether all impacts for this advisory have been unfurled.",
+    )
+
     objects = AdvisoryV2QuerySet.as_manager()
 
     class Meta:
@@ -3364,14 +3371,6 @@ class ImpactedPackage(models.Model):
         help_text="Timestamp of the last successful vers range unfurl.",
     )
 
-    is_latest = models.BooleanField(
-        default=False,
-        blank=False,
-        null=False,
-        db_index=True,
-        help_text="Indicates whether this is the latest impact for the advisory.",
-    )
-
     def to_dict(self):
         from vulnerabilities.utils import purl_to_dict
 
@@ -3536,26 +3535,22 @@ def _vulnerable(self, vulnerable=True):
         """
         return self.with_is_vulnerable().filter(is_vulnerable=vulnerable)
 
-    def vulnerable(self):
-        """
-        Return only packages that are vulnerable.
-        """
-        return self.filter(id__in=ImpactedPackageAffecting.objects.values("package_id").distinct())
-
     def with_is_vulnerable(self):
         """
         Annotate Package with ``is_vulnerable`` boolean attribute.
         """
         return self.annotate(
             is_vulnerable=Exists(
-                ImpactedPackage.objects.filter(affecting_packages__pk=OuterRef("pk"))
+                ImpactedPackage.objects.filter(
+                    affecting_packages__pk=OuterRef("pk"), advisory__is_latest=True
+                )
             )
         )
 
     def all_vulnerable(self):
         latest_impacts = ImpactedPackageAffecting.objects.filter(
             package_id=OuterRef("pk"),
-            impacted_package__is_latest=True,
+            impacted_package__advisory__is_latest=True,
         )
 
         query = PackageV2.objects.filter(Exists(latest_impacts))

vulnerabilities/models.py

@@ -58,8 +58,8 @@ def unfurl_version_range(self):
         cached_versions = {}
         update_unfurl_date = []
         update_successful_unfurl_date = []
-        update_batch_size = 5000
-        chunk_size = 5000
+        update_batch_size = 500
+        chunk_size = 500
 
         impacted_packages = impacted_package_qs(cutoff_day=self.reunfurl_after_days)
         impacted_packages_count = impacted_packages.count()

vulnerabilities/pipelines/v2_improvers/unfurl_version_range.py

@@ -374,8 +374,6 @@ def insert_advisory_v2(
     advisory_obj.risk_score = round(risk_score, 1) if risk_score is not None else None
     advisory_obj.save()
 
-    # Set all impacts as is_latest=False for the advisory before creating new impacts with is_latest=True. This ensures that only the impacts related to the latest advisory are marked as latest.
-    ImpactedPackage.objects.filter(advisory__avid=advisory_obj.avid).update(is_latest=False)
     for affected_pkg in advisory.affected_packages:
         impact = ImpactedPackage.objects.create(
             advisory=advisory_obj,
@@ -388,7 +386,6 @@ def insert_advisory_v2(
             fixed_vers=(
                 str(affected_pkg.fixed_version_range) if affected_pkg.fixed_version_range else None
             ),
-            is_latest=True,
         )
         package_affected_purls, package_fixed_purls = get_exact_purls_v2(
             affected_package=affected_pkg,

vulnerabilities/pipes/advisory.py

@@ -25,7 +25,7 @@ def package_prefetched_qs(checkpoint):
         .prefetch_related(
             Prefetch(
                 "affected_in_impacts",
-                queryset=ImpactedPackage.objects.filter(is_latest=True)
+                queryset=ImpactedPackage.objects.filter(advisory__is_latest=True)
                 .only("advisory_id")
                 .prefetch_related(
                     Prefetch(
@@ -36,7 +36,7 @@ def package_prefetched_qs(checkpoint):
             ),
             Prefetch(
                 "fixed_in_impacts",
-                queryset=ImpactedPackage.objects.filter(is_latest=True)
+                queryset=ImpactedPackage.objects.filter(advisory__is_latest=True)
                 .only("advisory_id")
                 .prefetch_related(
                     Prefetch(