Skip to content

Conversation

manuel-sommer
Copy link
Contributor

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

Copy link
Member

@valentijnscholten valentijnscholten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like this idea of populating the fix_available field in ways like this. Would it be helpful/needed to add to each parser doc how the field is populated? I remember a PR that was documenting for some parsers which fields from the report were parsed and how they were mapped. We could use AI to complete this for all parsers and then keep it up-to-date with parser changes?
Or even without that we could start adding a line to the docs of the parsers that set fix_available to indicate how the parsers decides on the value of the field? This is especially valuable if the value is derived from other fields or based on text matching of another field.

@valentijnscholten valentijnscholten added this to the 2.50.0 milestone Aug 27, 2025
Copy link
Member

@valentijnscholten valentijnscholten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should these fix_available PRs have a migration to set the field for existing findings?
Should they be combined into one PR to make it manageable for thsi release?

@manuel-sommer
Copy link
Contributor Author

I guess they don't need a migration as reimport with this PR #12922 will take care of this earlier or later
I intentionally splitted these into multiple MRs to make review easier / faster. This would provide a chance for some parsers to get merged if other parsers would be delayed because of review recommendations.

Copy link
Member

@valentijnscholten valentijnscholten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lots of people are using import and will have lots of existing findings. But I'm OK to keep it simple for now.
But I do think we need to add a line to the docs.

@valentijnscholten valentijnscholten merged commit 64e1754 into DefectDojo:bugfix Aug 29, 2025
87 checks passed
@manuel-sommer manuel-sommer deleted the trivy_fix_available branch August 30, 2025 19:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants