Interface for Grype to query graphql vuln store

[ajvpot]

STOP: Is this a security vulnerability? If so, follow Responsible Disclosure and email us at security@lunasec.io
instead of opening a public PR.

[dev-lunatrace-by-lunasec]

LUNATRACE IN DEV MODE

Build Snapshot Complete

View Full Report

Security Scan Findings

Showing 17 results.

Package Name	Versions	Severity	Locations
jackson-databind	2.6.4	Critical	1 location	Dismiss
redis	2.8.0	Critical	1 location	Dismiss
merge	1.2.1	Critical	1 location	Dismiss
docs	0.0.0-use.local	Critical	1 location	Dismiss
through	2.3.8	Critical	1 location	Dismiss
pac-resolver	4.2.0	Critical	1 location	Dismiss
immer	8.0.1	Critical	1 location	Dismiss
vm2	3.9.3	Critical	1 location	Dismiss
jsonpointer	5.0.0	Critical	1 location	Dismiss
ramda	0.24.1	Critical	1 location	Dismiss
shell-quote	1.7.2	Critical	1 location	Dismiss
minimist	0.0.8	Critical	1 location	Dismiss
minimist	1.2.5	Critical	2 locations	Dismiss
eventsource	1.1.0	Critical	1 location	Dismiss
ejs	3.1.6	Critical	1 location	Dismiss
github.com/hashicorp/go-getter	v1.5.9	Critical	1 location	Dismiss
ejs	2.7.4	Critical	1 location	Dismiss

[lunatrace-by-lunasec]

Build Snapshot Complete

View Full Report

Security Scan Findings

Showing 14 results.

Package Name	Versions	Severity	Locations
merge	1.2.1	Critical	1 location	Dismiss
pac-resolver	4.2.0	Critical	1 location	Dismiss
immer	8.0.1	Critical	1 location	Dismiss
vm2	3.9.3	Critical	1 location	Dismiss
jsonpointer	5.0.0	Critical	1 location	Dismiss
through	2.3.8	Critical	1 location	Dismiss
ramda	0.24.1	Critical	1 location	Dismiss
shell-quote	1.7.2	Critical	1 location	Dismiss
minimist	0.0.8	Critical	1 location	Dismiss
minimist	1.2.5	Critical	1 location	Dismiss
eventsource	1.1.0	Critical	1 location	Dismiss
ejs	3.1.6	Critical	1 location	Dismiss
github.com/hashicorp/go-getter	v1.5.9	Critical	1 location	Dismiss
ejs	2.7.4	Critical	1 location	Dismiss

[github-actions]

Hasura Semantic Diff

Hasura config files have changed. This comment shows which fields have changed ignoring formatting.

Click to expand!

object_relationships
  + one list entry added:
    - name: package
      using:
        foreign_key_constraint_on: package_id


(root level)
+ one map entry added:
  configuration:
    custom_root_fields: {}
    custom_name: vulnerability
    column_config: {}
    custom_column_names: {}

diff --git a/lunatrace/bsl/hasura/migrations/lunatrace/1655260379289_vulnerability-tweaks/down.sql b/lunatrace/bsl/hasura/migrations/lunatrace/1655260379289_vulnerability-tweaks/down.sql
new file mode 100644
index 00000000..aab7998a
--- /dev/null
+++ b/lunatrace/bsl/hasura/migrations/lunatrace/1655260379289_vulnerability-tweaks/down.sql
@@ -0,0 +1,3 @@
+ALTER TABLE vulnerability.affected
+    DROP CONSTRAINT IF EXISTS affected_package_id_fk;
+
diff --git a/lunatrace/bsl/hasura/migrations/lunatrace/1655260379289_vulnerability-tweaks/up.sql b/lunatrace/bsl/hasura/migrations/lunatrace/1655260379289_vulnerability-tweaks/up.sql
new file mode 100644
index 00000000..9e04a1b9
--- /dev/null
+++ b/lunatrace/bsl/hasura/migrations/lunatrace/1655260379289_vulnerability-tweaks/up.sql
@@ -0,0 +1,4 @@
+ALTER TABLE vulnerability.affected
+    ADD CONSTRAINT affected_package_id_fk
+        FOREIGN KEY (package_id) REFERENCES package.package;
+

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ ajvpot
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}