Examples refer to vulnerabilityWithRemediation that no longer exists

[djeverett]

We are using Black Duck v2024.7.1. The following files from your examples are using vulnerabilityWithRemediation, an attribute that no longer exists.

examples/get_bom_component_vulnerability_info.py
examples/vuln_redhat_remediate.py
examples/client/get_project_vulnerabilites_as_csv.py
examples/client/get_bom_component_vuln_info.py
examples/update_vuln_status.py
examples/generate_vulnerability_remediation_info.py
examples/vuln_batch_remediation.py

I have version 1.1.0 of your code.

[matthewb66]

API changes in BD-SCA are implemented with new header versions meaning that historical API formats are not deprecated.

The 'vulnerabilityWithRemediation' field in the response from the '/api/projects/{projectId}/versions/{projectVersionId}/vulnerable-bom-components' endpoint is still supported provided the correct API version header is specified (application/vnd.blackducksoftware.bill-of-materials-6+json) as opposed to the latest header (application/vnd.blackducksoftware.bill-of-materials-8+json).

My testing of the examples/get_bom_component_vulnerability_info.py script against a 2024.10.1 server version demonstrates this, with the script still returning all required data because it uses the correct API header version - provided the API request is modified to return 1000 or fewer responses (which was changed in a much earlier server version).

There is no fix required except to ensure that the limit of returned API responses is reduced to 1000 or less (previously 9999).

[wangleo61]

Great Job Matthew. BR Leo Wang On Jan 28, 2025, at 01:34, Matthew Brady ***@***.***> wrote: API changes in BD-SCA are implemented with new header versions meaning that historical API formats are not deprecated. The 'vulnerabilityWithRemediation' field in the response from the '/api/projects/{projectId}/versions/{projectVersionId}/vulnerable-bom-components' endpoint is still supported provided the correct API version header is specified (application/vnd.blackducksoftware.bill-of-materials-6+json) as opposed to the latest header (application/vnd.blackducksoftware.bill-of-materials-8+json). My testing of the examples/get_bom_component_vulnerability_info.py script against a 2024.10.1 server version demonstrates this, with the script still returning all required data - provided the API request is modified to return 1000 or fewer responses (which was changed in a much earlier server version). There is no fix required except to ensure that the limit of returned API responses is reduced to 1000 or less (previously 9999).

[LuckySkyWalker]

Here is an example of how the desired API version could be defined should you wish to overide the default of "latest"
Based on examples/client/get_bom_component_vulnerability_info.py

define the media type for published API version

media_type = "application/vnd.blackducksoftware.bill-of-materials-6+json"

header keys

hdr_keys = {}
hdr_keys['accept'] = media_type
hdr_keys['content-type'] = media_type

keyword arguments to pass through to API call

kwargs={}
kwargs['headers'] = hdr_keys

pass additional keys to your selected API

for bom_component_vuln in bd.get_resource('vulnerable-components', version, **kwargs):
etc etc