Skip to content

fix: store long advisories and mark skipped ones on results - #175

Merged
turegjorup merged 3 commits into
developfrom
feature/advisory-affected-versions-text
Nov 4, 2026
Merged

turegjorup merged 3 commits into
developfrom
feature/advisory-affected-versions-text

Conversation

@turegjorup

Copy link
Copy Markdown
Contributor

Link to ticket

https://leantime.itkdev.dk/#/tickets/showTicket/8363

Description

Store today's Symfony advisories. One of them did not fit the database and blocked the rest.

Changes:

  • Advisory: affectedVersions, title and link become TEXT. advisoryId (255) and cve (50) keep their size, with matching Length constraints.
  • AdvisoryFactory::unstorableReason() validates a new advisory before it is persisted. One that does not fit is skipped and logged as an error, instead of failing the flush of the whole result. ReleaseChecker uses the same check.
  • DetectionResult gets processingErrors, a list of what could not be processed. setAdvisories() returns the skipped advisories, including those for packages the installation does not list, and DockerImageHandler records them. ProcessDetectionResultHandler clears the list on every run, so a replay shows the current state. Shown on the detection result detail page.
  • Migration changes the three columns to TEXT and adds processing_errors, filling [] into existing rows.

Why: PKSA-b2gg-vk1g-6d5q (symfony/http-foundation) has a 543-character affectedVersions; the column held 500. The failed flush dropped every other new advisory in the same result, so none of the 2026-11-04 Symfony advisories were stored. Skips were only logged as warnings, which prod does not write.

Verified on a prod dump: after migrating and replaying the 7 rc2 docker results, all 18 Symfony advisories are stored and no result has processing errors.

Deploy: after deploy, replay the docker results to pick up the advisories that were dropped.

Checklist

  • My code is covered by test cases.
  • My code passes our test (all our tests).
  • My code passes our static analysis suite.
  • My code passes our continuous integration process.

@github-actions

github-actions Bot commented Nov 4, 2026

Copy link
Copy Markdown

API Specification - Non-breaking changes

No changelog changes

@codecov-commenter

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.18182% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.08%. Comparing base (12fc5ac) to head (4839bee).
⚠️ Report is 36 commits behind head on develop.

Files with missing lines Patch % Lines
src/Service/Drupal/ReleaseChecker.php 75.00% 3 Missing ⚠️
Additional details and impacted files
@@              Coverage Diff              @@
##             develop     #175      +/-   ##
=============================================
+ Coverage      69.27%   77.08%   +7.80%     
- Complexity      1300     1361      +61     
=============================================
  Files            168      172       +4     
  Lines           3987     4176     +189     
=============================================
+ Hits            2762     3219     +457     
+ Misses          1225      957     -268     
Flag Coverage Δ
unittests 77.08% <93.18%> (+7.80%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@turegjorup
turegjorup merged commit ab7a519 into develop Nov 4, 2026
14 checks passed
@turegjorup
turegjorup deleted the feature/advisory-affected-versions-text branch November 4, 2026 22:12
@turegjorup turegjorup mentioned this pull request Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants