Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix breaking change in NEW_VULNERABILITY notification JSON format #775

Merged
merged 4 commits into from
Aug 29, 2023

Conversation

nscuro
Copy link
Member

@nscuro nscuro commented Aug 29, 2023

Companion change to DependencyTrack/hyades-apiserver#290

Note: Because the original field numbers and types remain untouched, this is not a breaking change schema-wise. The name of the fields has changed, but this is only relevant to the JSON output, which is exactly what we want to fix here.

Companion change to DependencyTrack/hyades-apiserver#290

Note: Because the original field numbers and types remain untouched, this is not a breaking change schema-wise. The name of the fields has changed, but this is only relevant to the JSON output, which is exactly what we want to fix here.
Signed-off-by: nscuro <nscuro@protonmail.com>
@nscuro nscuro added the defect Something isn't working label Aug 29, 2023
@nscuro
Copy link
Member Author

nscuro commented Aug 29, 2023

buf is failing with:

Error: Field "4" with name "affected_projects_reference" on message "NewVulnerabilitySubject" changed option "json_name" from "affectedProjects" to "affectedProjectsReference".
Error: Field "4" on message "NewVulnerabilitySubject" changed name from "affected_projects" to "affected_projects_reference".

Both findings are expected, given my explanation in the description of this PR.

@nscuro
Copy link
Member Author

nscuro commented Aug 29, 2023

I found more occurrences of where the JSON field name generated by Protobuf deviates from what was originally used in vanilla Dependency-Track. Thus, buf is now complaining about these changes, too:

Error: Field "6" with name "sub_title" on message "Vulnerability" changed option "json_name" from "subTitle" to "subtitle".
Error: Field "9" with name "cvss_v2" on message "Vulnerability" changed option "json_name" from "cvssV2" to "cvssv2".
Error: Field "[10](https://github.com/DependencyTrack/hyades/actions/runs/6011875625/job/16306121778?pr=775#step:5:11)" with name "cvss_v3" on message "Vulnerability" changed option "json_name" from "cvssV3" to "cvssv3".
Error: Field "[11](https://github.com/DependencyTrack/hyades/actions/runs/6011875625/job/16306121778?pr=775#step:5:12)" with name "owasp_rr_likelihood" on message "Vulnerability" changed option "json_name" from "owaspRrLikelihood" to "owaspRRLikelihood".
Error: Field "[12](https://github.com/DependencyTrack/hyades/actions/runs/6011875625/job/16306121778?pr=775#step:5:13)" with name "owasp_rr_technical_impact" on message "Vulnerability" changed option "json_name" from "owaspRrTechnicalImpact" to "owaspRRTechnicalImpact".
Error: Field "[13](https://github.com/DependencyTrack/hyades/actions/runs/6011875625/job/16306121778?pr=775#step:5:14)" with name "owasp_rr_business_impact" on message "Vulnerability" changed option "json_name" from "owaspRrBusinessImpact" to "owaspRRBusinessImpact".
Error: Field "1" with name "id" on message "Alias" changed option "json_name" from "id" to "vulnId".

Again, this is expected.

…` notifications

Signed-off-by: nscuro <nscuro@protonmail.com>
@sonarcloud
Copy link

sonarcloud bot commented Aug 29, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication

@nscuro nscuro merged commit 25f7232 into main Aug 29, 2023
11 of 12 checks passed
@nscuro nscuro deleted the fix-breaking-notification-change branch August 29, 2023 14:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
defect Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants