Repository navigation
feat(report): keep advisory corpus metadata in a collapsed HTML footer - #449
Merged
Merged
Conversation
vg report --format html left #advisory-corpus empty, so vulnerability database provenance never appeared. The footer now records extended.vulnerabilities source, advisory and package counts, and severity counts after the finding tables, collapsed so those tables stay first. An unreachable source does not print zero counts, and the same artifact still produces the same HTML. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
…s-html-footer-ce5e Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
The HTML report names the recorded advisory source and count in a collapsed footer after the finding tables. A missing source stays Not scanned, Not checked, or Not recorded, and a missing count is omitted. Closes #245 Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
Keep the collapsed advisory-source footer and the Fix available only checkbox on the same page. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
…s-html-footer-ce5e Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com> Signed-off-by: Cursor Agent <cursoragent@cursor.com>
Keep the collapsed advisory-source footer and the Fix available only checkbox on the same page. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
vibgrate-team
marked this pull request as ready for review
October 12, 2026 12:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vg report --format htmlnow names advisory-database provenance in a collapsed footer after the vulnerability, security, and other-finding tables, so that metadata does not push the summary and finding tables down.The footer reads fields already stored on
extended.vulnerabilities:source—osv(OSV),manifest(offline package-version manifest),unreachable(Not checked), ornone(No packages to check)totalAdvisories, when it is a non-negative integer, including 0A missing vulnerability block says "Not scanned". Vulnerability findings with no recorded source say "Not recorded".
source: "unreachable"says "Not checked" and omits the count. An unknown source value is not copied onto the page. Strings are escaped like the rest of the page. The same artifact still produces the same HTML: no clock, no randomness, and the footer stays collapsed.The Fix available only checkbox stays on the page. It starts unchecked. Checking it hides rows that do not name a fix version. The page file still contains every row, and the summary counts stay complete.
DOCS.md notes that this provenance lives in the collapsed
#advisory-corpusfooter.Related issues
Closes #245
Checklist
pnpm testpassespnpm lintis cleanpnpm typecheckis cleangraph.json/ report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)git commit -s, DCO)Notes for reviewers
The footer stays collapsed (no
openattribute). Package names and advisory ids stay in the tables; the footer carries the source label and, when recorded, the advisory count.src/reporting/formatters/html.test.tsasserts footer content, placement after the finding tables, collapsed markup, the unchecked fix filter, and byte-stable output.