feat(vulnerability): adapt API to v13s vulnerability priority model by ybelMekk · Pull Request #452 · nais/api · GitHub

This pull request introduces support for a new "urgent" severity level for external ingress vulnerability issues in the GraphQL API, deprecating the previous "critical" level for this use case. It also enhances the vulnerability summary returned by the API by adding breakdowns by severity and priority. Additionally, several dependencies have been updated.

GraphQL API changes:

Added the ExternalIngressUrgentVulnerabilityIssue type, including its resolver, GraphQL schema definition, and support for resolving its fields and returning it from the Issue and Node interfaces. This enables clients to query for urgent ingress vulnerability issues separately from the deprecated critical type. [1] [2] [3] [4] [5] [6] [7] [8] [9]
Deprecated the EXTERNAL_INGRESS_CRITICAL_VULNERABILITY issue type in the GraphQL schema and introduced the new EXTERNAL_INGRESS_URGENT_VULNERABILITY type.
Enhanced the vulnerability summary GraphQL response to include countsBySeverity and countsByPriority fields, providing more granular statistics for clients. [1] [2]

Test updates:

Updated integration tests to expect the new urgent severity and message format for vulnerable image issues, reflecting the new severity logic.

Dependency updates:

Updated several dependencies in go.mod, including github.com/nais/v13s/pkg/api, golang.org/x/sync, google.golang.org/api, and github.com/googleapis/enterprise-certificate-proxy. [1] [2] [3]

Pull request overview

Updates the vulnerability domain in nais/api to match the latest v13s “risk-tier” model, while keeping GraphQL/API naming stable and exposing additional CVE signal data needed by the frontend.

Changes:

Adds EPSS/KEV/ransomware signals (and fix version) to ImageVulnerability, and introduces derived CVEPriority on CVE.
Extends sorting/filtering to support priority-based ordering for image vulnerabilities, CVEs, and workload vulnerability summaries.
Updates issue generation to use tier counts (ACT_NOW/HIGH_RISK) and introduces a new issue type for external-ingress workloads with ACT_NOW vulnerabilities.

Reviewed changes

Copilot reviewed 15 out of 19 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
internal/vulnerability/transform.go	Maps new CVE signal fields and tier summary fields into API models.
internal/vulnerability/transform_test.go	Adds unit tests for CVE priority derivation.
internal/vulnerability/sortfilter.go	Registers new sort fields for priority/tier counts.
internal/vulnerability/queries.go	Adds priority ordering for CVEs and hardens totalCount → int32 conversion.
internal/vulnerability/models.go	Extends models with CVE priority enum + new fields (EPSS/KEV/etc).
internal/vulnerability/fake/fakedata.go	Updates fake vulnerability summaries/findings to include tier and signal fields.
internal/issue/queries.go	Adds conversion support for the new issue type details payload.
internal/issue/model.go	Defines the new issue type and its details struct.
internal/issue/checker/workload_v13s.go	Updates issue logic to use tier counts; adds external-ingress ACT_NOW issue emission.
internal/graph/schema/vulnerability.graphqls	Extends public GraphQL schema with new fields/enums/sort options.
internal/graph/schema/issues.graphqls	Adds the new issue type + GraphQL type.
internal/graph/issues.resolvers.go	Wires resolvers for the new issue GraphQL type.
internal/graph/gengql/vulnerability.generated.go	Regenerates gqlgen output for vulnerability schema changes.
internal/graph/gengql/schema.generated.go	Regenerates gqlgen output for schema/type additions.
internal/graph/gengql/root_.generated.go	Regenerates gqlgen resolver root + complexity updates.
internal/graph/gengql/issues.generated.go	Regenerates gqlgen output for the new issue type.
integration_tests/issues_for_team.lua	Updates expected message/severity for vulnerable image issues.
go.mod	Bumps v13s API dependency to include risk-tier summary model updates.
go.sum	Updates dependency checksums accordingly.

Files not reviewed (3)

internal/graph/gengql/issues.generated.go: Language not supported
internal/graph/gengql/schema.generated.go: Language not supported
internal/graph/gengql/vulnerability.generated.go: Language not supported

Nå er det veldig mange tall på f.eks. ImageVulnerabilitySummary. Skal noen av de gamle få en @deprecated? Hvordan skal brukerne vite hva som skal brukes og ikke?

Nå er det veldig mange tall på f.eks. ImageVulnerabilitySummary. Skal noen av de gamle få en @deprecated? Hvordan skal brukerne vite hva som skal brukes og ikke?

Godt poeng 👍 Dette er ikke ment som “gamle vs nye” tall, men ulike dimensjoner

critical/high/medium/low/unassigned = alvorlighetsgrad (CVSS-fordeling)
priorityActNow/high/elevated/monitor + topVulnerabilityPriority = operasjonell prioritet (hva bør håndteres først)
highEpssCount = ekstra risikosignaler

Enig med @thokra-nav her, det blir veldig mange int / float felt direkte på den ImageVulnerabilitySummary typen. Er det noen måte å gruppere dem på så ikke alle trenger å ligge samlet? Er det sånn at alle feltene brukes for å kalkulere noe, eller brukes et subsett for å kalkulere noe, og et annet subsett for å kalkulere noe annet?

Det hadde vært fint å kunne markere "det gamle" med @deprecated om vi ønsker at folk skal bruke "det nye" i stedet.

Pull request overview

Copilot reviewed 17 out of 21 changed files in this pull request and generated 7 comments.

Files not reviewed (3)

internal/graph/gengql/issues.generated.go: Generated file
internal/graph/gengql/schema.generated.go: Generated file
internal/graph/gengql/vulnerability.generated.go: Generated file

…checker - Add priorityActNow, priorityHigh, priorityElevated, priorityMonitor fields to ImageVulnerabilitySummary model - Expose priority fields in vulnerability.graphqls and GraphQL resolvers - Add VULNERABILITY_PRIORITY_ACT_NOW and VULNERABILITY_PRIORITY_HIGH sort fields - Add ExternalIngressActNowVulnerabilityIssue type and issue checker - Map priority signals (EPSS, KEV, ransomware) via VulnerabilityPrioritySignals - Bump golang.org/x/net to v0.55.0 and golang.org/x/crypto to v0.52.0 to fix known vulnerabilities - Update v13s/pkg/api to v0.0.0-20260525171357-13563f32226d (priority_elevated, priority_monitor support)

…pssCount

…messages

…ue type and resolvers

…ming

… for clarity

…s for consistency

…dling in workload processing

…ate related GraphQL schema

…with counts by severity and priority

…ilities

nais-team-app Bot added the graphql-review-required label Jun 2, 2026

ybelMekk force-pushed the feat/cve-priority branch from f9eb406 to 3a773f3 Compare June 3, 2026 09:57

ybelMekk requested a review from Copilot June 4, 2026 08:18

Copilot started reviewing on behalf of ybelMekk June 4, 2026 08:18 View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

ybelMekk force-pushed the feat/cve-priority branch from 3d8ae28 to c82b22d Compare June 8, 2026 10:27

ybelMekk marked this pull request as ready for review June 8, 2026 10:28

ybelMekk requested a review from a team as a code owner June 8, 2026 10:28

ybelMekk changed the title fix(vulnerability): adapt API to v13s risk-tier model feat(vulnerability): adapt API to v13s risk-tier model Jun 8, 2026

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from a580717 to 82b803e Compare June 15, 2026 08:10

thokra-nav reviewed Jun 16, 2026

View reviewed changes

Comment thread internal/issue/checker/workload_v13s.go Outdated

Comment thread internal/issue/checker/workload_v13s.go

Comment thread internal/vulnerability/transform.go Outdated

ybelMekk changed the title feat(vulnerability): adapt API to v13s risk-tier model feat(vulnerability): adapt API to v13s vulnerability priority model Jun 17, 2026

ybelMekk mentioned this pull request Jun 17, 2026

fix(issue): support haproxy external ingress priority detection #465

Open

ybelMekk force-pushed the feat/cve-priority branch from 4277e04 to fd27b92 Compare June 19, 2026 07:17

thokra-nav reviewed Jun 22, 2026

View reviewed changes

Comment thread internal/issue/checker/workload_v13s.go Outdated

Comment thread internal/graph/schema/issues.graphqls

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from 2de4d20 to 2e9d9f6 Compare June 30, 2026 10:24

ybelMekk requested a review from Copilot June 30, 2026 11:07

Copilot started reviewing on behalf of ybelMekk June 30, 2026 11:07 View session

Copilot AI reviewed Jun 30, 2026

View reviewed changes

ybelMekk force-pushed the feat/cve-priority branch from 589763e to 7d3d693 Compare July 2, 2026 10:51

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from 5abc538 to a673558 Compare August 5, 2026 11:11

ybelMekk requested a review from thokra-nav August 5, 2026 11:20

ybelMekk force-pushed the feat/cve-priority branch 2 times, most recently from ac964f8 to 6cbc049 Compare August 20, 2026 07:47

ybelMekk added 21 commits August 26, 2026 11:40

fix(issue): only flag immediate vulnerabilities

db03b59

test(vulnerability): remove outdated CVE priority derivation tests

950554e

feat(vulnerability): add riskTier field to vulnerability summaries

bbcfb66

chore(deps): align v13s api with main

06d14d1

refactor(vulnerability): hard-remove priority summary extras

f2621fb

chore(deps): bump v13s api to latest main

de3e165

fix(vulnerability): revert ingress class tests

bbd014f

refactor(vulnerability): rename CVE priority IMMEDIATE to ACT_NOW

caa9992

fix(issue): replace immediate wording with ACT_NOW

2e47ef1

refactor(vulnerability): rename riskTier to priority and remove highE…

6501f37

…pssCount

fix(vulnerability): update ACT_NOW wording to lowercase 'act_now' in …

a2ce654

…messages

fix(vulnerability): deprecate ExternalIngressCriticalVulnerabilityIss…

a9731da

…ue type and resolvers

refactor(vulnerability): clarify priority summary and urgent issue na…

48fb2d7

…ming

chore: resolve dependency file conflicts after rebase

fa55616

refactor(vulnerability): adjust formatting of deprecation annotations…

09dd40a

… for clarity

refactor(vulnerability): improve formatting of deprecation annotation…

9e13a12

…s for consistency

refactor(vulnerability): enhance ordering enums and improve error han…

dd911ed

…dling in workload processing

fix(vulnerability): address priority API review feedback

586abc9

feat(vulnerability): add priority field to ImageVulnerability and upd…

3fad4f1

…ate related GraphQL schema

feat(vulnerability): enhance Team and Tenant vulnerability summaries …

05d3a62

…with counts by severity and priority

feat(vulnerability): update priority filter handling in queries

7d618c4

ybelMekk force-pushed the feat/cve-priority branch from 2b48b2e to 7d618c4 Compare August 26, 2026 09:47

feat(vulnerability): add external ingress support for urgent vulnerab…

307d691

…ilities

christeredvartsen requested changes Aug 26, 2026

View reviewed changes

Comment thread internal/graph/schema/vulnerability.graphqls Outdated

refactor: remove unused stuff

0116396

thokra-nav approved these changes Aug 26, 2026

View reviewed changes

nais-team-app Bot removed the graphql-review-required label Aug 26, 2026

christeredvartsen approved these changes Aug 26, 2026

View reviewed changes

ybelMekk merged commit 5fd4fb1 into main Aug 27, 2026
12 checks passed

ybelMekk deleted the feat/cve-priority branch August 27, 2026 06:57

feat(vulnerability): adapt API to v13s vulnerability priority model by ybelMekk · Pull Request #452 · nais/api · GitHub

Uh oh!

feat(vulnerability): adapt API to v13s vulnerability priority model - #452

feat(vulnerability): adapt API to v13s vulnerability priority model#452ybelMekk merged 42 commits intomainnais/api:mainfrom feat/cve-prioritynais/api:feat/cve-priorityCopy head branch name to clipboard

Conversation

ybelMekk commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thokra-nav left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ybelMekk commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

christeredvartsen commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

feat(vulnerability): adapt API to v13s vulnerability priority model#452
ybelMekk merged 42 commits into
mainfrom
feat/cve-priority

ybelMekk commented Jun 2, 2026 •
edited
Loading

ybelMekk commented Jun 16, 2026 •
edited
Loading

christeredvartsen commented Jun 22, 2026 •
edited
Loading