Add through model to track creation date of impact package relation

Signed-off-by: Keshav Priyadarshi <git@keshav.space>

Author: keshav-space

vulnerabilities/migrations/0115_impactedpackageaffecting_and_more.py

@@ -0,0 +1,107 @@
+# Generated by Django 5.2.11 on 2026-02-19 11:12
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("vulnerabilities", "0114_advisoryv2_related_advisory_severities"),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name="impactedpackage",
+            name="affecting_packages",
+        ),
+        migrations.RemoveField(
+            model_name="impactedpackage",
+            name="fixed_by_packages",
+        ),
+        migrations.AlterField(
+            model_name="advisoryv2",
+            name="date_collected",
+            field=models.DateTimeField(
+                auto_now_add=True,
+                db_index=True,
+                help_text="UTC Date on which the advisory was collected",
+            ),
+        ),
+        migrations.CreateModel(
+            name="ImpactedPackageAffecting",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True, db_index=True)),
+                (
+                    "impacted_package",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to="vulnerabilities.impactedpackage",
+                    ),
+                ),
+                (
+                    "package",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, to="vulnerabilities.packagev2"
+                    ),
+                ),
+            ],
+            options={
+                "unique_together": {("impacted_package", "package")},
+            },
+        ),
+        migrations.AddField(
+            model_name="impactedpackage",
+            name="affecting_packages",
+            field=models.ManyToManyField(
+                help_text="Packages vulnerable to this impact.",
+                related_name="affected_in_impacts",
+                through="vulnerabilities.ImpactedPackageAffecting",
+                to="vulnerabilities.packagev2",
+            ),
+        ),
+        migrations.CreateModel(
+            name="ImpactedPackageFixedBy",
+            fields=[
+                (
+                    "id",
+                    models.AutoField(
+                        auto_created=True, primary_key=True, serialize=False, verbose_name="ID"
+                    ),
+                ),
+                ("created_at", models.DateTimeField(auto_now_add=True, db_index=True)),
+                (
+                    "impacted_package",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        to="vulnerabilities.impactedpackage",
+                    ),
+                ),
+                (
+                    "package",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, to="vulnerabilities.packagev2"
+                    ),
+                ),
+            ],
+            options={
+                "unique_together": {("impacted_package", "package")},
+            },
+        ),
+        migrations.AddField(
+            model_name="impactedpackage",
+            name="fixed_by_packages",
+            field=models.ManyToManyField(
+                help_text="Packages fixing the vulnerable packages in this impact.",
+                related_name="fixed_in_impacts",
+                through="vulnerabilities.ImpactedPackageFixedBy",
+                to="vulnerabilities.packagev2",
+            ),
+        ),
+    ]

vulnerabilities/models.py

@@ -3143,13 +3143,15 @@ class ImpactedPackage(models.Model):
     affecting_packages = models.ManyToManyField(
         "PackageV2",
         related_name="affected_in_impacts",
+        through="ImpactedPackageAffecting",
         help_text="Packages vulnerable to this impact.",
     )
 
     fixed_by_packages = models.ManyToManyField(
         "PackageV2",
         related_name="fixed_in_impacts",
-        help_text="Packages vulnerable to this impact.",
+        through="ImpactedPackageFixedBy",
+        help_text="Packages fixing the vulnerable packages in this impact.",
     )
 
     introduced_by_package_commit_patches = models.ManyToManyField(
@@ -3497,6 +3499,44 @@ def current_version(self):
         return self.version_class(self.version)
 
 
+class ImpactedPackageAffecting(models.Model):
+    impacted_package = models.ForeignKey(
+        ImpactedPackage,
+        on_delete=models.CASCADE,
+    )
+    package = models.ForeignKey(
+        PackageV2,
+        on_delete=models.CASCADE,
+    )
+
+    created_at = models.DateTimeField(
+        auto_now_add=True,
+        db_index=True,
+    )
+
+    class Meta:
+        unique_together = ("impacted_package", "package")
+
+
+class ImpactedPackageFixedBy(models.Model):
+    impacted_package = models.ForeignKey(
+        ImpactedPackage,
+        on_delete=models.CASCADE,
+    )
+    package = models.ForeignKey(
+        PackageV2,
+        on_delete=models.CASCADE,
+    )
+
+    created_at = models.DateTimeField(
+        auto_now_add=True,
+        db_index=True,
+    )
+
+    class Meta:
+        unique_together = ("impacted_package", "package")
+
+
 class AdvisoryExploit(models.Model):
     """
     A vulnerability exploit is code used to