Insecure list: fetch "affected versions" information from SA-s for more accurate reporting

[mxr576]

Story

Swiftmailer had an SA last night. No new release just the complete project were marked as unsupported. (According to updates.drupal.org). Also, the project has no supported branches anymore.

Due to these changes, all releases of Swiftmailer was marked an unsupported instead of insecure yesterday.

• unsupported changes vs
• insecure changes

If we only leverage the updates.drupal.org API then the only way to have all releases marked as insecure by this tool is flagging them with the special "Insecure" term.

I asked that change on Drupal Slack (see thread dump below) - which may or may not be applied on the project releases - and it triggered an another changed on the published SA: Affected versions field were set to *, it was empty before.

Conclusion

For a more bulletproof process, probably there is no way to further delay parsing "affected versions" information from Drupal.org API and incorporating that to the results. Probably it would simplify version range guessing, or even eliminate that in some cases.

Tasks

• Go through this list and collect field_affected_versions information for projects - IF it is available. (Watch out: "Pagination links are incorrect on https://www.drupal.org/api-d7/node.json, they contain node instead of node.json , which means when you follow those you get an HTML 404 page instead of a HTTP 200 JSON response.") For this, we need a new integration with this API endpoint.
• Incorporate collected information the the insecure list generation process.

Notes

The mentioned Swiftmailer SA as JSON: https://www.drupal.org/api-d7/node.json?nid=3416755

Attachments

Slack thread dump, generated at 2024/01/25 10:09:37

[mxr576]

Hint:

The project is only available by preference on an SA... exchanging references to project names may come with a small overhead.

      "field_project": {
        "uri": "https://www.drupal.org/api-d7/node/1163884",
        "id": "1163884",
        "resource": "node"
      },

Idea:

Store the SA's title, created date and URL in the generated composer.json's extra section for those packages where the new API provided the insecure version range. This information could be later leveraged in ddqg-composer-audit for exposing more accurate information.