Merge branch 'main' into feat/collections-v2-aggregate-pipes-IN-1193-IN-1195

Author: gaspergrom

backend/.env.dist.local

@@ -199,7 +199,7 @@ OSSPCKGS_GCP_CREDENTIALS_B64=e30=
 # maven/all.zip 404s). The allowlist check and DB storage normalize to lowercase
 # internally per ADR-0001 §OSV "Ecosystem normalization", so downstream stays lowercase.
 OSV_BULK_BASE_URL=https://osv-vulnerabilities.storage.googleapis.com
-OSV_ECOSYSTEMS=npm,Maven,cargo,NuGet
+OSV_ECOSYSTEMS=npm,Maven,cargo,NuGet,RubyGems,Go
 OSV_TMP_DIR=/tmp/osv
 OSV_BATCH_SIZE=500
 OSV_DERIVE_BATCH_SIZE=1000

backend/src/api/public/v1/members/createMember.ts

@@ -3,7 +3,7 @@ import { z } from 'zod'
 
 import { captureApiChange, memberCreateAction, memberEditIdentitiesAction } from '@crowd/audit-logs'
 import { getProperDisplayName } from '@crowd/common'
-import { insertManyMemberIdentities, createMember as insertMember } from '@crowd/data-access-layer'
+import { createMember as insertMember, insertMemberIdentities } from '@crowd/data-access-layer'
 import { MemberIdentityType } from '@crowd/types'
 
 import { optionsQx } from '@/database/sequelizeQueryExecutor'
@@ -49,7 +49,7 @@ export async function createMember(req: Request, res: Response): Promise<void> {
         manuallyCreated: true,
       })
 
-      const dbIdentities = await insertManyMemberIdentities(
+      const dbIdentities = await insertMemberIdentities(
         tx,
         identities.map((identity) => ({
           ...identity,

backend/src/api/public/v1/members/identities/createMemberIdentity.ts

@@ -7,7 +7,7 @@ import {
   MemberField,
   findMemberById,
   findMemberIdentitiesByValue,
-  createMemberIdentity as insertMemberIdentity,
+  insertMemberIdentities,
   touchMemberUpdatedAt,
   updateMemberIdentity,
 } from '@crowd/data-access-layer'
@@ -69,20 +69,23 @@ export async function createMemberIdentity(req: Request, res: Response): Promise
             alreadyExisted = true
             result = exactMatch
           } else {
-            result = await insertMemberIdentity(
+            const [created] = await insertMemberIdentities(
               tx,
-              {
-                memberId,
-                platform: data.platform,
-                value: normalizedValue,
-                type: data.type,
-                source: data.source,
-                verified: data.verified,
-                verifiedBy: data.verifiedBy,
-              },
+              [
+                {
+                  memberId,
+                  platform: data.platform,
+                  value: normalizedValue,
+                  type: data.type,
+                  source: data.source,
+                  verified: data.verified,
+                  verifiedBy: data.verifiedBy,
+                },
+              ],
               true,
               true,
             )
+            result = created
           }
 
           // A verified identity confirms the same value for this member, so keep same-value

backend/src/api/public/v1/members/project-affiliations/patchProjectAffiliation.ts

@@ -85,14 +85,16 @@ export async function patchProjectAffiliation(req: Request, res: Response): Prom
         if (affiliations.length > 0) {
           await insertMemberSegmentAffiliations(
             tx,
-            memberId,
-            projectId,
             affiliations.map((a) => ({
+              memberId,
+              segmentId: projectId,
               organizationId: a.organizationId,
               dateStart: a.dateStart.toISOString(),
               dateEnd: a.dateEnd?.toISOString() ?? null,
+              verified: true,
               verifiedBy: verifiedBy!,
             })),
+            true,
           )
         }
       })

backend/src/api/public/v1/packages/getPackage.ts

@@ -130,7 +130,7 @@ export async function getPackage(req: Request, res: Response): Promise<void> {
     },
     provenance: {
       repositoryMapping: {
-        declaredRepo: pkg.repoUrl ?? pkg.repositoryUrl ?? pkg.declaredRepositoryUrl ?? null,
+        declaredRepo: pkg.repoUrl ?? pkg.repositoryUrl ?? null,
         mappingConfidence,
         mappingLabel: repoMappingLabel(mappingConfidence),
         lastCommitAt: pkg.repoLastCommitAt ? pkg.repoLastCommitAt.toISOString() : null,

backend/src/database/repositories/member/memberAffiliationsRepository.ts

@@ -2,7 +2,7 @@ import { OrganizationField, queryOrgs } from '@crowd/data-access-layer'
 import {
   deleteMemberSegmentAffiliations,
   fetchMemberAffiliations,
-  insertMemberAffiliations,
+  insertMemberSegmentAffiliations,
 } from '@crowd/data-access-layer/src/member_segment_affiliations'
 import { fetchManySegments } from '@crowd/data-access-layer/src/segments'
 import { IMemberAffiliation, IOrganization, SegmentData } from '@crowd/types'
@@ -89,8 +89,17 @@ class MemberAffiliationsRepository {
       await deleteMemberSegmentAffiliations(qx, { memberId })
 
       if (data?.length > 0) {
-        //  Insert multiple member affiliations
-        await insertMemberAffiliations(qx, memberId, data)
+        await insertMemberSegmentAffiliations(
+          qx,
+          data.map((item) => ({
+            memberId,
+            segmentId: item.segmentId,
+            organizationId: item.organizationId,
+            dateStart: item.dateStart || null,
+            dateEnd: item.dateEnd || null,
+          })),
+          true,
+        )
       }
 
       await SequelizeRepository.commitTransaction(transaction)

backend/src/database/repositories/memberRepository.ts

@@ -18,11 +18,11 @@ import {
 import { BotDetectionService, CommonMemberService } from '@crowd/common_services'
 import {
   OrganizationField,
-  createMemberIdentity,
   deleteMemberIdentities,
   deleteMemberIdentitiesByCombinations,
   findAlreadyExistingVerifiedIdentities,
   getLastActivitiesForMembers,
+  insertMemberIdentities,
   queryActivityRelations,
   queryOrgs,
   updateVerifiedFlag,
@@ -33,7 +33,7 @@ import { addMemberNoMerge, removeMemberToMerge } from '@crowd/data-access-layer/
 import {
   deleteMemberSegmentAffiliations,
   findMemberAffiliations,
-  insertMemberAffiliations,
+  insertMemberSegmentAffiliations,
 } from '@crowd/data-access-layer/src/member_segment_affiliations'
 import {
   MemberField,
@@ -159,8 +159,9 @@ class MemberRepository {
     const subprojectIds = await getSegmentSubprojectIds(qx, currentSegments)
 
     if (data.identities) {
-      for (const i of data.identities as IMemberIdentity[]) {
-        await createMemberIdentity(qx, {
+      await insertMemberIdentities(
+        qx,
+        (data.identities as IMemberIdentity[]).map((i) => ({
           memberId: record.id,
           platform: i.platform,
           type: i.type,
@@ -169,15 +170,16 @@ class MemberRepository {
           integrationId: i.integrationId || null,
           verified: i.verified,
           source: i.source,
-        })
-      }
+        })),
+      )
     } else if (data.username) {
       const username: PlatformIdentities = mapUsernameToIdentities(data.username)
 
+      const identitiesToInsert = []
       for (const platform of Object.keys(username) as PlatformType[]) {
         const identities: any[] = username[platform]
         for (const identity of identities) {
-          await createMemberIdentity(qx, {
+          identitiesToInsert.push({
             memberId: record.id,
             platform,
             value: identity.value ? identity.value : identity.username,
@@ -189,6 +191,10 @@ class MemberRepository {
           })
         }
       }
+
+      if (identitiesToInsert.length > 0) {
+        await insertMemberIdentities(qx, identitiesToInsert)
+      }
     }
 
     await includeMemberToSegments(qx, record.id, subprojectIds)
@@ -1049,8 +1055,9 @@ class MemberRepository {
     }
 
     if (data.identitiesToCreate && data.identitiesToCreate.length > 0) {
-      for (const i of data.identitiesToCreate) {
-        await createMemberIdentity(qx, {
+      await insertMemberIdentities(
+        qx,
+        data.identitiesToCreate.map((i) => ({
           memberId: record.id,
           platform: i.platform,
           value: i.value,
@@ -1059,8 +1066,8 @@ class MemberRepository {
           integrationId: i.integrationId || null,
           verified: i.verified !== undefined ? i.verified : !!manualChange,
           source: i.source,
-        })
-      }
+        })),
+      )
     }
 
     if (data.identitiesToUpdate && data.identitiesToUpdate.length > 0) {
@@ -1094,6 +1101,7 @@ class MemberRepository {
         const platformsToDelete: string[] = []
         const valuesToDelete: string[] = []
         const typesToDelete: MemberIdentityType[] = []
+        const identitiesToInsert = []
 
         for (const platform of platforms) {
           const identities = data.username[platform]
@@ -1112,7 +1120,7 @@ class MemberRepository {
               (identity.username && identity.username !== '') ||
               (identity.value && identity.value !== '')
             ) {
-              await createMemberIdentity(qx, {
+              identitiesToInsert.push({
                 memberId: record.id,
                 platform,
                 value: identity.value ? identity.value : identity.username,
@@ -1126,6 +1134,10 @@ class MemberRepository {
           }
         }
 
+        if (identitiesToInsert.length > 0) {
+          await insertMemberIdentities(qx, identitiesToInsert)
+        }
+
         if (platformsToDelete.length > 0) {
           await deleteMemberIdentitiesByCombinations(qx, {
             memberId: record.id,
@@ -1207,7 +1219,17 @@ class MemberRepository {
           return
         }
 
-        await insertMemberAffiliations(qx, memberId, data)
+        await insertMemberSegmentAffiliations(
+          qx,
+          data.map((item) => ({
+            memberId,
+            segmentId: item.segmentId,
+            organizationId: item.organizationId,
+            dateStart: item.dateStart || null,
+            dateEnd: item.dateEnd || null,
+          })),
+          true,
+        )
       }),
     )
   }

backend/src/database/repositories/organizationRepository.ts

@@ -16,7 +16,6 @@ import {
   IDbOrganization,
   OrgIdentityField,
   OrganizationField,
-  addOrgIdentity,
   addOrgsToSegments,
   cleanUpOrgIdentities,
   cleanupForOganization,
@@ -27,6 +26,7 @@ import {
   findManyOrgAttributes,
   findOrgAttributes,
   findOrgById,
+  insertOrganizationIdentities,
   markOrgAttributeDefault,
   queryOrgIdentities,
   updateOrgIdentityVerifiedFlag,
@@ -619,16 +619,22 @@ class OrganizationRepository {
   ): Promise<void> {
     const qx = SequelizeRepository.getQueryExecutor(options)
 
-    await addOrgIdentity(qx, {
-      organizationId,
-      platform: identity.platform,
-      source: identity.source,
-      sourceId: identity.sourceId || null,
-      value: identity.value,
-      type: identity.type,
-      verified: identity.verified,
-      integrationId: identity.integrationId || null,
-    })
+    await insertOrganizationIdentities(
+      qx,
+      [
+        {
+          organizationId,
+          platform: identity.platform,
+          source: identity.source,
+          sourceId: identity.sourceId || null,
+          value: identity.value,
+          type: identity.type,
+          verified: identity.verified,
+          integrationId: identity.integrationId || null,
+        },
+      ],
+      false,
+    )
   }
 
   static async getIdentities(

backend/src/services/member/memberIdentityService.ts

@@ -3,7 +3,7 @@ import lodash from 'lodash'
 
 import { captureApiChange, memberEditIdentitiesAction } from '@crowd/audit-logs'
 import { Error404, Error409 } from '@crowd/common'
-import { createMemberIdentity, findIdentitiesForMembers } from '@crowd/data-access-layer'
+import { findIdentitiesForMembers, insertMemberIdentities } from '@crowd/data-access-layer'
 import {
   deleteMemberIdentity,
   fetchMemberIdentities,
@@ -77,7 +77,7 @@ export default class MemberIdentityService extends LoggerBase {
           }
 
           // Create member identity
-          await createMemberIdentity(qx, { ...data, memberId })
+          await insertMemberIdentities(qx, [{ ...data, memberId }])
 
           await touchMemberUpdatedAt(qx, memberId)
 
@@ -151,9 +151,10 @@ export default class MemberIdentityService extends LoggerBase {
           }
 
           // Create member identities
-          for (const identity of data) {
-            await createMemberIdentity(qx, { ...identity, memberId })
-          }
+          await insertMemberIdentities(
+            qx,
+            data.map((identity) => ({ ...identity, memberId })),
+          )
 
           await touchMemberUpdatedAt(qx, memberId)
 

docs/adr/0004-go-nuget-transitive-dependent-counts.md

@@ -97,4 +97,14 @@ methodology. We chose exact over an HLL-sketch approximation, accepting the high
 - **Weekly trigger.** No new schedule — the `go`/`nuget` variants are already child workflows of
   `bootstrapOsspckgs`, which the existing `osspckgs-bootstrap-weekly` schedule runs incrementally.
 
+## Addendum: RUBYGEMS (2026-07-13)
+RubyGems is also absent from deps.dev's `Dependents` reverse index (verified via BQ 2026-07-13:
+`Dependents` contains only NPM/MAVEN/PYPI/CARGO) and has no resolved/transitive graph table, only
+the raw manifest `RubyGemsRequirementsLatest` — same shape as GO/NUGET. It was added as a third
+`isScript` closure variant (`dependent_counts_rubygems`), reusing this ADR's design unchanged:
+same semi-naive fixpoint, same `isScript` pipeline integration, same guard/monitor pattern. Corpus
+is NUGET-scale (1.7M pkgs / 4.5M runtime edges), so cost/runtime are expected to track NUGET, not
+GO. This ADR's title and body still say "GO/NUGET" for the original decision; treat this addendum
+as extending scope to a third ecosystem rather than superseding the analysis above.
+
 Related: ADR-0003 (deps BQ table selection — same root cause: GO/NUGET absent from the resolved-graph tables).