Repository navigation
Conversation
Fixes two related data quality bugs in the GitLab v2 importer: Issue aboutcode-org#2411 - GitLab data source damages package versions: - GitLab advisories frequently ship fixed_versions with a leading 'v' prefix (e.g. 'v2.0.1') that some version classes reject. - Strip the 'v' prefix before passing to vrc.version_class() so parsable versions are no longer silently discarded. - Improve the error log message to include the normalized form and the package PURL for easier debugging. Issue aboutcode-org#2412 - We do not collect the affected range for GitLab advisories: - When both affected_version_range and fixed_version_range are None the function previously returned None, silently dropping the advisory. - Return a partial AdvisoryDataV2 (without affected_packages) instead, so the record is still stored and can be enriched by downstream improvers. - Emit a WARNING-level log so operators can see which advisories lack version data. Tests added: - test_parse_gitlab_advisory_v_prefix_fixed_version: verifies that a 'v'-prefixed fixed version is accepted and produces a valid fixed_version_range. - test_parse_gitlab_advisory_unparsable_version_still_stored: verifies that an advisory with a completely unparsable version is not dropped (returns AdvisoryDataV2 with empty affected_packages). Signed-off-by: Muhammad Adnan <muhammad1414114@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes two related data quality bugs in the GitLab Advisory Database v2 importer:
Changes
1. Handle
v-prefixed fixed versions (#2411)fixed_versionswith a leadingv(e.g.,"v2.0.1"). Some version classes reject this format, causing valid versions to be discarded silently.fixed_versionstrings by stripping the leading"v"prior to callingvrc.version_class().2. Avoid dropping advisories with unparsable version ranges (#2412)
affected_version_rangeandfixed_version_rangeevaluated toNone,parse_gitlab_advisory()returnedNone, discarding the entire advisory.AdvisoryDataV2instance withoutaffected_packages. This ensures advisory metadata is preserved in the database and can be enriched by downstream improvers.WARNING-level log when storing an advisory without version ranges.Tests Added
test_parse_gitlab_advisory_v_prefix_fixed_version: Validates that av-prefixed version without anaffected_rangeparses into a validfixed_version_range.test_parse_gitlab_advisory_unparsable_version_still_stored: Validates that advisories with completely unparsable version strings are retained rather than discarded.###Note
iam open to learning and all the stuff so if any advice or sujjestion is there or like any mistakes please tell me