Change API V3 structure

TG1999 · TG1999 · commit 797277628741 · 2026-02-16T16:47:04.000+05:30
Signed-off-by: Tushar Goel &lt;tushar.goel.dav@gmail.com&gt;
diff --git a/vulnerabilities/api_v2.py b/vulnerabilities/api_v2.py
@@ -41,6 +41,7 @@
 from vulnerabilities.models import VulnerabilitySeverity
 from vulnerabilities.models import Weakness
 from vulnerabilities.throttling import PermissionBasedUserRateThrottle
+from vulnerabilities.utils import group_advisories_by_content
 
 
 class CharInFilter(filters.BaseInFilter, filters.CharFilter):
@@ -361,19 +362,39 @@ def get_affected_by_vulnerabilities(self, package):
 
         latest_advisories = AdvisoryV2.objects.latest_for_avids(avids)
         advisory_by_avid = {adv.avid: adv for adv in latest_advisories}
+        impact_by_avid = {}
 
-        result = {}
-
+        advisories = []
         for impact in impacts:
             avid = impact.advisory.avid
             advisory = advisory_by_avid.get(avid)
             if not advisory:
                 continue
-            fixed_by_packages = [pkg.purl for pkg in impact.fixed_by_packages.all()]
-            result[advisory.avid] = {
-                "advisory_id": advisory.avid,
-                "fixed_by_packages": fixed_by_packages,
-            }
+            advisories.append(advisory)
+            impact_by_avid[avid] = impact
+
+        grouped_advisories = group_advisories_by_content(advisories=advisories)
+
+        advs = []
+
+        for hash in grouped_advisories:
+            advs.append(grouped_advisories[hash])
+        
+        result = []
+
+        for advisory in advs:
+            primary_advisory = advisory["primary"]
+            avid = primary_advisory.avid
+            impact = impact_by_avid.get(avid)
+            if not impact:
+                continue
+            result.append(
+                {
+                    "advisory_id": primary_advisory.avid,
+                    "fixed_by_packages": [pkg.purl for pkg in impact.fixed_by_packages.all()],
+                    "duplicate_advisory_ids": [adv.avid for adv in advisory["secondary"]],
+                }
+            )
 
         return result
 
@@ -384,7 +405,25 @@ def get_fixing_vulnerabilities(self, package):
 
         latest_advisories = AdvisoryV2.objects.latest_for_avids(avids)
 
-        return [adv.avid for adv in latest_advisories]
+        grouped_advisories = group_advisories_by_content(advisories=latest_advisories)
+
+        advs = []
+
+        for hash in grouped_advisories:
+            advs.append(grouped_advisories[hash])
+
+        result = []
+
+        for advisory in advs:
+            primary_advisory = advisory["primary"]
+            result.append(
+                {
+                    "advisory_id": primary_advisory.avid,
+                    "duplicate_advisory_ids": [adv.avid for adv in advisory["secondary"]],
+                }
+            )
+
+        return result
 
     def get_next_non_vulnerable_version(self, package):
         if next_non_vulnerable := package.get_non_vulnerable_versions()[0]:
@@ -1078,14 +1117,14 @@ def list(self, request, *args, **kwargs):
             return self.get_paginated_response(
                 {
                     "packages": serializer.data,
-                    "advisories": advisory_data,
+                    "advisories_by_id": advisory_data,
                 }
             )
 
         return Response(
             {
                 "packages": serializer.data,
-                "advisories": advisory_data,
+                "advisories_by_id": advisory_data,
             }
         )
 
@@ -1160,7 +1199,7 @@ def bulk_lookup(self, request):
         return Response(
             {
                 "packages": package_data,
-                "advisories": advisory_data,
+                "advisories_by_id": advisory_data,
             }
         )
 
@@ -1254,7 +1293,7 @@ def bulk_search(self, request):
                 return Response(
                     {
                         "packages": package_data,
-                        "advisories": advisory_data,
+                        "advisories_by_id": advisory_data,
                     }
                 )
 
@@ -1308,7 +1347,7 @@ def bulk_search(self, request):
             return Response(
                 {
                     "packages": package_data,
-                    "advisories": advisory_data,
+                    "advisories_by_id": advisory_data,
                 }
             )
 
diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py
@@ -69,8 +69,10 @@
 from vulnerabilities.importer import AdvisoryDataV2
 from vulnerabilities.severity_systems import EPSS
 from vulnerabilities.severity_systems import SCORING_SYSTEMS
-from vulnerabilities.utils import compute_patch_checksum, normalize_list, normalize_text
+from vulnerabilities.utils import compute_patch_checksum
+from vulnerabilities.utils import normalize_list
 from vulnerabilities.utils import normalize_purl
+from vulnerabilities.utils import normalize_text
 from vulnerabilities.utils import purl_to_dict
 from vulnerablecode import __version__ as VULNERABLECODE_VERSION
 from vulnerablecode.settings import VULNERABLECODE_PIPELINE_TIMEOUT
@@ -3058,7 +3060,7 @@ def get_aliases(self):
         Return a queryset of all Aliases for this vulnerability.
         """
         return self.aliases.all()
-    
+
     def compute_advisory_content(self):
         """
         Compute a unique content hash for an advisory by normalizing its data and hashing it.
diff --git a/vulnerabilities/pipelines/__init__.py b/vulnerabilities/pipelines/__init__.py
@@ -265,6 +265,7 @@ class VulnerableCodeBaseImporterPipelineV2(VulnerableCodePipeline):
     spdx_license_expression = None
     repo_url = None
     ignorable_versions = []
+    precedence = 0
 
     # Control how often progress log is shown (range: 1–100, higher value = less frequent log)
     progress_step = 10
@@ -318,6 +319,7 @@ def collect_and_store_advisories(self):
                     advisory=advisory,
                     pipeline_id=self.pipeline_id,
                     logger=self.log,
+                    precedence=self.precedence,
                 ):
                     collected_advisory_count += 1
             except Exception as e:
diff --git a/vulnerabilities/pipelines/v2_importers/alpine_linux_importer.py b/vulnerabilities/pipelines/v2_importers/alpine_linux_importer.py
@@ -38,6 +38,8 @@ class AlpineLinuxImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://secdb.alpinelinux.org/license.txt"
     repo_url = "git+https://github.com/aboutcode-org/aboutcode-mirror-alpine-secdb/"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/aosp_importer.py b/vulnerabilities/pipelines/v2_importers/aosp_importer.py
@@ -31,6 +31,8 @@ class AospImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     spdx_license_expression = "Apache-2.0"
     license_url = "https://github.com/quarkslab/aosp_dataset/blob/master/LICENSE"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/apache_httpd_importer.py b/vulnerabilities/pipelines/v2_importers/apache_httpd_importer.py
@@ -152,6 +152,8 @@ class ApacheHTTPDImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://www.apache.org/licenses/LICENSE-2.0"
     base_url = "https://httpd.apache.org/security/json/"
 
+    precedence = 200
+
     links = []
 
     ignorable_versions = frozenset(
diff --git a/vulnerabilities/pipelines/v2_importers/apache_kafka_importer.py b/vulnerabilities/pipelines/v2_importers/apache_kafka_importer.py
@@ -48,6 +48,8 @@ class ApacheKafkaImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
         "CVE-2021-4104",
     ]
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/apache_tomcat_importer.py b/vulnerabilities/pipelines/v2_importers/apache_tomcat_importer.py
@@ -40,6 +40,8 @@ class ApacheTomcatImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://www.apache.org/licenses/LICENSE-2.0"
     base_url = "https://tomcat.apache.org/security"
 
+    precedence = 200
+
     def fetch_advisory_links(self):
         """
         Yield the URLs of each Tomcat version security-related page.
diff --git a/vulnerabilities/pipelines/v2_importers/archlinux_importer.py b/vulnerabilities/pipelines/v2_importers/archlinux_importer.py
@@ -28,6 +28,8 @@ class ArchLinuxImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     spdx_license_expression = "MIT"
     license_url = "https://github.com/archlinux/arch-security-tracker/blob/master/LICENSE"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/curl_importer.py b/vulnerabilities/pipelines/v2_importers/curl_importer.py
@@ -37,6 +37,8 @@ class CurlImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     repo_url = "https://github.com/curl/curl-www/"
     url = "https://curl.se/docs/vuln.json"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (cls.collect_and_store_advisories,)
diff --git a/vulnerabilities/pipelines/v2_importers/debian_importer.py b/vulnerabilities/pipelines/v2_importers/debian_importer.py
@@ -76,6 +76,8 @@ class DebianImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
         Moritz
     """
 
+    precedence = 200
+
     api_url = "https://security-tracker.debian.org/tracker/data/json"
     response = None
 
diff --git a/vulnerabilities/pipelines/v2_importers/elixir_security_importer.py b/vulnerabilities/pipelines/v2_importers/elixir_security_importer.py
@@ -36,6 +36,8 @@ class ElixirSecurityImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/dependabot/elixir-security-advisories/blob/master/LICENSE.txt"
     repo_url = "git+https://github.com/dependabot/elixir-security-advisories"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (cls.clone, cls.collect_and_store_advisories, cls.clean_downloads)
diff --git a/vulnerabilities/pipelines/v2_importers/epss_importer_v2.py b/vulnerabilities/pipelines/v2_importers/epss_importer_v2.py
@@ -30,6 +30,8 @@ class EPSSImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     spdx_license_expression = "unknown"
     importer_name = "EPSS Importer"
 
+    precedence = 200
+
     def advisories_count(self):
         return len(self.lines)
 
diff --git a/vulnerabilities/pipelines/v2_importers/fireeye_importer_v2.py b/vulnerabilities/pipelines/v2_importers/fireeye_importer_v2.py
@@ -40,6 +40,8 @@ class FireeyeImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     repo_url = "git+https://github.com/mandiant/Vulnerability-Disclosures"
     pipeline_id = "fireeye_importer_v2"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/github_osv_importer.py b/vulnerabilities/pipelines/v2_importers/github_osv_importer.py
@@ -31,6 +31,8 @@ class GithubOSVImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/github/advisory-database/blob/main/LICENSE.md"
     repo_url = "git+https://github.com/github/advisory-database/"
 
+    precedence = 100
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/gitlab_importer.py b/vulnerabilities/pipelines/v2_importers/gitlab_importer.py
@@ -45,6 +45,8 @@ class GitLabImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://gitlab.com/gitlab-org/advisories-community/-/blob/main/LICENSE"
     repo_url = "git+https://gitlab.com/gitlab-org/advisories-community/"
 
+    precedence = 100
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/istio_importer.py b/vulnerabilities/pipelines/v2_importers/istio_importer.py
@@ -43,6 +43,8 @@ class IstioImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/istio/istio.io/blob/master/LICENSE"
     repo_url = "git+https://github.com/istio/istio.io"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/mattermost_importer.py b/vulnerabilities/pipelines/v2_importers/mattermost_importer.py
@@ -40,6 +40,8 @@ class MattermostImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
 
     _cached_data = None  # Class-level cache
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (cls.collect_and_store_advisories,)
diff --git a/vulnerabilities/pipelines/v2_importers/mozilla_importer.py b/vulnerabilities/pipelines/v2_importers/mozilla_importer.py
@@ -45,6 +45,8 @@ class MozillaImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     spdx_license_expression = "MPL-2.0"
     license_url = "https://github.com/mozilla/foundation-security-advisories/blob/master/LICENSE"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/nginx_importer.py b/vulnerabilities/pipelines/v2_importers/nginx_importer.py
@@ -37,6 +37,8 @@ class NginxImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://nginx.org/LICENSE"
     url = "https://nginx.org/en/security_advisories.html"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/npm_importer.py b/vulnerabilities/pipelines/v2_importers/npm_importer.py
@@ -41,6 +41,8 @@ class NpmImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/nodejs/security-wg/blob/main/LICENSE.md"
     repo_url = "git+https://github.com/nodejs/security-wg"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/nvd_importer.py b/vulnerabilities/pipelines/v2_importers/nvd_importer.py
@@ -71,6 +71,8 @@ class NVDImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
         MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
     """
 
+    precedence = 100
+
     @classmethod
     def steps(cls):
         return (cls.collect_and_store_advisories,)
diff --git a/vulnerabilities/pipelines/v2_importers/openssl_importer.py b/vulnerabilities/pipelines/v2_importers/openssl_importer.py
@@ -40,6 +40,8 @@ class OpenSSLImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/openssl/openssl/blob/master/LICENSE.txt"
     repo_url = "git+https://github.com/openssl/release-metadata/"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/oss_fuzz.py b/vulnerabilities/pipelines/v2_importers/oss_fuzz.py
@@ -27,6 +27,8 @@ class OSSFuzzImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/google/oss-fuzz-vulns/blob/main/LICENSE"
     repo_url = "git+https://github.com/google/oss-fuzz-vulns"
 
+    precedence = 100
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/postgresql_importer.py b/vulnerabilities/pipelines/v2_importers/postgresql_importer.py
@@ -38,6 +38,8 @@ class PostgreSQLImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
 
     links = set()
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (cls.collect_and_store_advisories,)
diff --git a/vulnerabilities/pipelines/v2_importers/project_kb_msr2019_importer.py b/vulnerabilities/pipelines/v2_importers/project_kb_msr2019_importer.py
@@ -30,6 +30,8 @@ class ProjectKBMSR2019Pipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/SAP/project-kb/blob/main/LICENSE.txt"
     repo_url = "git+https://github.com/SAP/project-kb"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/project_kb_statements_importer.py b/vulnerabilities/pipelines/v2_importers/project_kb_statements_importer.py
@@ -37,6 +37,8 @@ class ProjectKBStatementsPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/SAP/project-kb/blob/main/LICENSE.txt"
     repo_url = "git+https://github.com/SAP/project-kb@vulnerability-data"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/pysec_importer.py b/vulnerabilities/pipelines/v2_importers/pysec_importer.py
@@ -29,6 +29,7 @@ class PyPIImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://github.com/pypa/advisory-database/blob/main/LICENSE"
     url = "https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip"
     spdx_license_expression = "CC-BY-4.0"
+    precedence = 100
 
     @classmethod
     def steps(cls):
diff --git a/vulnerabilities/pipelines/v2_importers/redhat_importer.py b/vulnerabilities/pipelines/v2_importers/redhat_importer.py
@@ -46,6 +46,8 @@ class RedHatImporterPipeline(VulnerableCodeBaseImporterPipelineV2):
     license_url = "https://access.redhat.com/security/data/"
     url = "https://security.access.redhat.com/data/csaf/v2/advisories/"
 
+    precedence = 200
+
     @classmethod
     def steps(cls):
         return (
diff --git a/vulnerabilities/pipelines/v2_importers/retiredotnet_importer.py b/vulnerabilities/pipelines/v2_importers/retiredotnet_importer.py
diff --git a/vulnerabilities/pipelines/v2_importers/ruby_importer.py b/vulnerabilities/pipelines/v2_importers/ruby_importer.py
diff --git a/vulnerabilities/pipelines/v2_importers/ubuntu_osv_importer.py b/vulnerabilities/pipelines/v2_importers/ubuntu_osv_importer.py
diff --git a/vulnerabilities/pipelines/v2_importers/vulnrichment_importer.py b/vulnerabilities/pipelines/v2_importers/vulnrichment_importer.py
diff --git a/vulnerabilities/pipelines/v2_importers/xen_importer.py b/vulnerabilities/pipelines/v2_importers/xen_importer.py
diff --git a/vulnerabilities/pipes/advisory.py b/vulnerabilities/pipes/advisory.py
diff --git a/vulnerabilities/templates/package_details_v2.html b/vulnerabilities/templates/package_details_v2.html
diff --git a/vulnerabilities/utils.py b/vulnerabilities/utils.py
diff --git a/vulnerabilities/views.py b/vulnerabilities/views.py

Original file line number	Diff line number	Diff line change
`@@ -48,6 +48,8 @@ class ApacheKafkaImporterPipeline(VulnerableCodeBaseImporterPipelineV2):`
`48`	`48`	`"CVE-2021-4104",`
`49`	`49`	`]`
`50`	`50`
	`51`	`+ precedence = 200`
	`52`	`+`
`51`	`53`	`@classmethod`
`52`	`54`	`def steps(cls):`
`53`	`55`	`return (`