Migrate scancode.io from vulnerabilties to advisories for consuming VCIO API

[TG1999]

Migration from vuln based API to advisory based API is in progress right now.

We should plan migration and usage of API in scancode.io for same.

[Jadhav-Dhanashri]

Hello maintainers,
I’m interested in working on this issue as part of GSoC. I’ve gone through the issue details and related code, and I’d love to take ownership and start contributing.

If it’s available, could you please assign this issue to me?

[David-Bamson]

Hi, I've been exploring the codebase in preparation for GSoC 2026. I reviewed (scanpipe/pipes/vulnerablecode.py) and can see the functions that currently use the vulnerability-based API specifically (_get_vulnerabilities), (fetch_vulnerabilities), and the bulk search functions. I'd like to work on this migration and would appreciate guidance on the expected approach for the refactor particularly around how the new advisory-based responses should map to the existing data model.

[sohamrajput98]

Hi @TG1999 @tdruez, I'm a GSoC 2026 applicant interested in this issue. Before writing any code I did some research:

Mapped all files referencing affected_by_vulnerabilities - the migration touches 10+ files across pipes, models, views, serializers, templates, and migrations, not just vulnerablecode.py
Confirmed PR #2067 was closed for doing only a normalization wrapper - I understand a full refactor is needed
Checked public.vulnerablecode.io/api/ - the advisories endpoint isn't live yet, still returning the old format

Two questions before I finalize my proposal:

Should the migration target a local vulnerablecode instance, or design for both formats during transition?
Is there a staging endpoint with the new advisory API I can test against?

Happy to share my proposal draft early for feedback

[sohamrajput98]

Hi @TG1999 @tdruez, I'm a GSoC 2026 applicant interested in this issue. Before writing any code I did some research:

Mapped all files referencing affected_by_vulnerabilities - the migration touches 10+ files across pipes, models, views, serializers, templates, and migrations, not just vulnerablecode.py Confirmed PR #2067 was closed for doing only a normalization wrapper - I understand a full refactor is needed Checked public.vulnerablecode.io/api/ - the advisories endpoint isn't live yet, still returning the old format

Two questions before I finalize my proposal:

Should the migration target a local vulnerablecode instance, or design for both formats during transition? Is there a staging endpoint with the new advisory API I can test against?

Happy to share my proposal draft early for feedback

---

I've put together an initial proposal draft based on my research - would appreciate early feedback from mentors before I finalize it.
GOOGLE DOC LINK - https://docs.google.com/document/d/1AJdaqC3d8mctYp2JX3vNCOpLZV9_lB13ANNk_6eRXNo/edit?usp=sharing

[roy-stack-web]

Hi, I started working on this issue and began migrating fetch_vulnerabilities to an advisory-based structure (renamed to fetch_advisories and updated related fields).

I will continue extending this to API-level changes and other affected areas.

[sujayxbarui]

Hi, I’m planning to apply for GSoC 2026 and I’m interested in working on the migration of ScanCode.io to the advisory-based API in VulnerableCode.

From my exploration, it seems that the main changes would involve:

• Refactoring the fetch_vulnerabilities flow to consume advisory data
• Updating pipeline logic to align with the new advisory structure
• Adapting data models and processing steps accordingly

I’m currently mapping how vulnerability data flows through ScanCode.io and how this would change with the advisory-based approach.

I’d appreciate guidance on:

• Which component (API integration vs pipeline refactor vs models) would be the best starting point
• Any existing design considerations I should keep in mind while drafting the proposal

Thanks!

[sohamrajput98]

Hi @tdruez @TG1999, GSoC deadline is March 31. I've shared my proposal draft and submitted PR #2105 to the codebase (all CI passing). Could you spare 2 minutes to confirm if my proposed approach for the full-stack migration aligns with what you have in mind? Happy to adjust before submission.

[mohanaddalol]

Hello, I am interested in this GSoC project. I have experience in software development and cybersecurity projects, and I have started exploring how the vulnerability-based API is currently used in ScanCode.io. I would appreciate any guidance on approaching the migration to the advisory-based API. Thank you.