Conversation
There was a problem hiding this comment.
Pull request overview
Adjusts vulnerability classification range filtering to avoid overlapping buckets by making the upper bound exclusive.
Changes:
- Updated
raw_risk_assessmentfilters from<= ?to< ?across multiple statistics queries. - Updated
cvssfilters from<= ?to< ?across multiple statistics queries.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| JOIN release_items ri ON dv.asset_version_name = ri.asset_version_name AND dv.asset_id = ri.asset_id | ||
| JOIN cves c ON dv.cve_id = c.cve | ||
| WHERE ri.release_id IN (SELECT id FROM release_tree) AND fe.type IN ? AND c.cvss >= ? AND c.cvss <= ? | ||
| WHERE ri.release_id IN (SELECT id FROM release_tree) AND fe.type IN ? AND c.cvss >= ? AND c.cvss < ? |
There was a problem hiding this comment.
Switching the upper bound from inclusive (<=) to exclusive (<) will exclude rows where the score equals the upper boundary. This is especially risky for the top bucket (e.g., CVSS can validly be 10.0), which would be dropped if the caller passes 10.0 as the upper bound. Consider keeping the final bucket inclusive (use <= ? for the max-range query) or ensure the caller passes an exclusive sentinel upper bound (e.g., 10.0001 or math.MaxFloat) so boundary values aren’t lost.
| WHERE ri.release_id IN (SELECT id FROM release_tree) AND fe.type IN ? AND c.cvss >= ? AND c.cvss < ? | |
| WHERE ri.release_id IN (SELECT id FROM release_tree) AND fe.type IN ? AND c.cvss >= ? AND c.cvss <= ? |
| JOIN artifact_dependency_vulns adv ON dependency_vulns.id = adv.dependency_vuln_id | ||
| WHERE | ||
| fe.type IN ? AND dependency_vulns.asset_version_name = ? AND dependency_vulns.asset_id = ? AND dependency_vulns.raw_risk_assessment >= ? AND dependency_vulns.raw_risk_assessment <= ? | ||
| fe.type IN ? AND dependency_vulns.asset_version_name = ? AND dependency_vulns.asset_id = ? AND dependency_vulns.raw_risk_assessment >= ? AND dependency_vulns.raw_risk_assessment < ? |
There was a problem hiding this comment.
The same range predicate pattern (>= ? and < ?) is duplicated across several query blocks in this file (for both raw_risk_assessment and cvss). To reduce the chance of future inconsistencies (like mixed inclusive/exclusive bounds across queries), consider centralizing the range predicate construction (e.g., a small helper/const fragment used by each query builder) and documenting the intended interval semantics (half-open vs closed).
No description provided.