feat(vulnerability): adapt API to v13s vulnerability priority model by ybelMekk · Pull Request #452 · nais/api

ybelMekk · 2026-06-02T11:12:15Z

This pull request introduces support for a new "urgent" severity level for external ingress vulnerability issues in the GraphQL API, deprecating the previous "critical" level for this use case. It also enhances the vulnerability summary returned by the API by adding breakdowns by severity and priority. Additionally, several dependencies have been updated.

GraphQL API changes:

Added the ExternalIngressUrgentVulnerabilityIssue type, including its resolver, GraphQL schema definition, and support for resolving its fields and returning it from the Issue and Node interfaces. This enables clients to query for urgent ingress vulnerability issues separately from the deprecated critical type. [1] [2] [3] [4] [5] [6] [7] [8] [9]
Deprecated the EXTERNAL_INGRESS_CRITICAL_VULNERABILITY issue type in the GraphQL schema and introduced the new EXTERNAL_INGRESS_URGENT_VULNERABILITY type.
Enhanced the vulnerability summary GraphQL response to include countsBySeverity and countsByPriority fields, providing more granular statistics for clients. [1] [2]

Test updates:

Updated integration tests to expect the new urgent severity and message format for vulnerable image issues, reflecting the new severity logic.

Dependency updates:

Updated several dependencies in go.mod, including github.com/nais/v13s/pkg/api, golang.org/x/sync, google.golang.org/api, and github.com/googleapis/enterprise-certificate-proxy. [1] [2] [3]

Copilot

Pull request overview

Updates the vulnerability domain in nais/api to match the latest v13s “risk-tier” model, while keeping GraphQL/API naming stable and exposing additional CVE signal data needed by the frontend.

Changes:

Adds EPSS/KEV/ransomware signals (and fix version) to ImageVulnerability, and introduces derived CVEPriority on CVE.
Extends sorting/filtering to support priority-based ordering for image vulnerabilities, CVEs, and workload vulnerability summaries.
Updates issue generation to use tier counts (ACT_NOW/HIGH_RISK) and introduces a new issue type for external-ingress workloads with ACT_NOW vulnerabilities.

Reviewed changes

Copilot reviewed 15 out of 19 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
internal/vulnerability/transform.go	Maps new CVE signal fields and tier summary fields into API models.
internal/vulnerability/transform_test.go	Adds unit tests for CVE priority derivation.
internal/vulnerability/sortfilter.go	Registers new sort fields for priority/tier counts.
internal/vulnerability/queries.go	Adds priority ordering for CVEs and hardens totalCount → int32 conversion.
internal/vulnerability/models.go	Extends models with CVE priority enum + new fields (EPSS/KEV/etc).
internal/vulnerability/fake/fakedata.go	Updates fake vulnerability summaries/findings to include tier and signal fields.
internal/issue/queries.go	Adds conversion support for the new issue type details payload.
internal/issue/model.go	Defines the new issue type and its details struct.
internal/issue/checker/workload_v13s.go	Updates issue logic to use tier counts; adds external-ingress ACT_NOW issue emission.
internal/graph/schema/vulnerability.graphqls	Extends public GraphQL schema with new fields/enums/sort options.
internal/graph/schema/issues.graphqls	Adds the new issue type + GraphQL type.
internal/graph/issues.resolvers.go	Wires resolvers for the new issue GraphQL type.
internal/graph/gengql/vulnerability.generated.go	Regenerates gqlgen output for vulnerability schema changes.
internal/graph/gengql/schema.generated.go	Regenerates gqlgen output for schema/type additions.
internal/graph/gengql/root_.generated.go	Regenerates gqlgen resolver root + complexity updates.
internal/graph/gengql/issues.generated.go	Regenerates gqlgen output for the new issue type.
integration_tests/issues_for_team.lua	Updates expected message/severity for vulnerable image issues.
go.mod	Bumps v13s API dependency to include risk-tier summary model updates.
go.sum	Updates dependency checksums accordingly.

Files not reviewed (3)

internal/graph/gengql/issues.generated.go: Language not supported
internal/graph/gengql/schema.generated.go: Language not supported
internal/graph/gengql/vulnerability.generated.go: Language not supported

thokra-nav

Nå er det veldig mange tall på f.eks. ImageVulnerabilitySummary. Skal noen av de gamle få en @deprecated? Hvordan skal brukerne vite hva som skal brukes og ikke?

ybelMekk · 2026-06-16T11:25:16Z

Nå er det veldig mange tall på f.eks. ImageVulnerabilitySummary. Skal noen av de gamle få en @deprecated? Hvordan skal brukerne vite hva som skal brukes og ikke?

Godt poeng 👍 Dette er ikke ment som “gamle vs nye” tall, men ulike dimensjoner

critical/high/medium/low/unassigned = alvorlighetsgrad (CVSS-fordeling)
priorityActNow/high/elevated/monitor + topVulnerabilityPriority = operasjonell prioritet (hva bør håndteres først)
highEpssCount = ekstra risikosignaler

christeredvartsen · 2026-06-22T07:41:51Z

Enig med @thokra-nav her, det blir veldig mange int / float felt direkte på den ImageVulnerabilitySummary typen. Er det noen måte å gruppere dem på så ikke alle trenger å ligge samlet? Er det sånn at alle feltene brukes for å kalkulere noe, eller brukes et subsett for å kalkulere noe, og et annet subsett for å kalkulere noe annet?

Det hadde vært fint å kunne markere "det gamle" med @deprecated om vi ønsker at folk skal bruke "det nye" i stedet.

Copilot

Pull request overview

Copilot reviewed 17 out of 21 changed files in this pull request and generated 7 comments.

Files not reviewed (3)

internal/graph/gengql/issues.generated.go: Generated file
internal/graph/gengql/schema.generated.go: Generated file
internal/graph/gengql/vulnerability.generated.go: Generated file

…checker - Add priorityActNow, priorityHigh, priorityElevated, priorityMonitor fields to ImageVulnerabilitySummary model - Expose priority fields in vulnerability.graphqls and GraphQL resolvers - Add VULNERABILITY_PRIORITY_ACT_NOW and VULNERABILITY_PRIORITY_HIGH sort fields - Add ExternalIngressActNowVulnerabilityIssue type and issue checker - Map priority signals (EPSS, KEV, ransomware) via VulnerabilityPrioritySignals - Bump golang.org/x/net to v0.55.0 and golang.org/x/crypto to v0.52.0 to fix known vulnerabilities - Update v13s/pkg/api to v0.0.0-20260525171357-13563f32226d (priority_elevated, priority_monitor support)

…; fix ExternalIngressActNow resolver stubs; add priority sort fields

…ier to ImageVulnerabilitySummary

…pssCount

…messages

…ue type and resolvers

…ming

… for clarity

…s for consistency

…dling in workload processing

…ate related GraphQL schema

…with counts by severity and priority

nais-team-app Bot added the graphql-review-required label Jun 2, 2026

ybelMekk force-pushed the feat/cve-priority branch from f9eb406 to 3a773f3 Compare June 3, 2026 09:57

ybelMekk requested a review from Copilot June 4, 2026 08:18

Copilot started reviewing on behalf of ybelMekk June 4, 2026 08:18 View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

ybelMekk force-pushed the feat/cve-priority branch from 3d8ae28 to c82b22d Compare June 8, 2026 10:27

ybelMekk marked this pull request as ready for review June 8, 2026 10:28

ybelMekk requested a review from a team as a code owner June 8, 2026 10:28

ybelMekk changed the title ~~fix(vulnerability): adapt API to v13s risk-tier model~~ feat(vulnerability): adapt API to v13s risk-tier model Jun 8, 2026

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from a580717 to 82b803e Compare June 15, 2026 08:10

thokra-nav reviewed Jun 16, 2026

View reviewed changes

Comment thread internal/issue/checker/workload_v13s.go Outdated

Comment thread internal/issue/checker/workload_v13s.go

Comment thread internal/vulnerability/transform.go Outdated

ybelMekk changed the title ~~feat(vulnerability): adapt API to v13s risk-tier model~~ feat(vulnerability): adapt API to v13s vulnerability priority model Jun 17, 2026

ybelMekk mentioned this pull request Jun 17, 2026

fix(issue): support haproxy external ingress priority detection #465

Open

ybelMekk force-pushed the feat/cve-priority branch from 4277e04 to fd27b92 Compare June 19, 2026 07:17

thokra-nav reviewed Jun 22, 2026

View reviewed changes

Comment thread internal/issue/checker/workload_v13s.go Outdated

Comment thread internal/graph/schema/issues.graphqls

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from 2de4d20 to 2e9d9f6 Compare June 30, 2026 10:24

ybelMekk requested a review from Copilot June 30, 2026 11:07

Copilot started reviewing on behalf of ybelMekk June 30, 2026 11:07 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

ybelMekk force-pushed the feat/cve-priority branch from 589763e to 7d3d693 Compare July 2, 2026 10:51

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from 5abc538 to a673558 Compare August 5, 2026 11:11

ybelMekk requested a review from thokra-nav August 5, 2026 11:20

ybelMekk force-pushed the feat/cve-priority branch from a673558 to ac964f8 Compare August 17, 2026 07:37

ybelMekk added 2 commits August 20, 2026 09:47

feat(vulnerability): expose CVE priority, EPSS, KEV fields in GraphQL…

e6ab217

…; fix ExternalIngressActNow resolver stubs; add priority sort fields

ybelMekk added 27 commits August 20, 2026 09:47

feat(vulnerability): expose KEV and EPSS fields on ImageVulnerability

a0c0f81

fix(vulnerability): map PRIORITY sort to cve priority order

a8b87c5

chore(deps): bump v13s api after exploitable removal

e16ffbd

fix(vulnerability): clean enum docs and normalize fake EPSS percentile

7ef4d13

feat(vulnerability): add ransomwareCount, highEpssCount, and topRiskT…

3cdd34c

…ier to ImageVulnerabilitySummary

feat(vulnerability): add riskTier field to vulnerability summaries

eaa1630

chore(deps): bump v13s api

b77900f

feat(vulnerability): align CVE priority with v13s priority

fe3edce

fix(vulnerability): remove legacy risk-tier fallback

ac4f693

fix(issue): only flag immediate vulnerabilities

c43f960

test(vulnerability): remove outdated CVE priority derivation tests

9a3b3e8

feat(vulnerability): add riskTier field to vulnerability summaries

b745d22

chore(deps): align v13s api with main

1dbf350

refactor(vulnerability): hard-remove priority summary extras

053234f

chore(deps): bump v13s api to latest main

4c5045b

fix(vulnerability): revert ingress class tests

511c13b

refactor(vulnerability): rename CVE priority IMMEDIATE to ACT_NOW

3be8b14

fix(issue): replace immediate wording with ACT_NOW

1015271

refactor(vulnerability): rename riskTier to priority and remove highE…

141827b

…pssCount

fix(vulnerability): update ACT_NOW wording to lowercase 'act_now' in …

960cee4

…messages

fix(vulnerability): deprecate ExternalIngressCriticalVulnerabilityIss…

bb7e09a

…ue type and resolvers

refactor(vulnerability): clarify priority summary and urgent issue na…

d27f536

…ming

chore: resolve dependency file conflicts after rebase

59ef388

refactor(vulnerability): adjust formatting of deprecation annotations…

4654bff

… for clarity

refactor(vulnerability): improve formatting of deprecation annotation…

5e3b175

…s for consistency

refactor(vulnerability): enhance ordering enums and improve error han…

75d0881

…dling in workload processing

fix(vulnerability): address priority API review feedback

6cbc049

ybelMekk force-pushed the feat/cve-priority branch from ac964f8 to 6cbc049 Compare August 20, 2026 07:47

ybelMekk added 2 commits August 25, 2026 13:37

feat(vulnerability): add priority field to ImageVulnerability and upd…

8fcd028

…ate related GraphQL schema

feat(vulnerability): enhance Team and Tenant vulnerability summaries …

83d1867

…with counts by severity and priority

Uh oh!

Conversation

ybelMekk commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thokra-nav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ybelMekk commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christeredvartsen commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ybelMekk commented Jun 2, 2026 •

edited

Loading

ybelMekk commented Jun 16, 2026 •

edited

Loading

christeredvartsen commented Jun 22, 2026 •

edited

Loading