Repository navigation
feat(vulns): add read-only detail vulns command for security scan findings - #339
Merged
Merged
Conversation
…dings Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Current Aviator status
This PR was merged manually (without Aviator). Merging manually can negatively impact the performance of the queue. Consider using Aviator next time.
See the real-time status of this PR on the
Aviator webapp.
Use the Aviator Chrome Extension
to see the status of your PR within GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
No issues found across 10 files
Tip: Get a Slack DM when cubic finishes reviewing your PRs. Connect Slack
View guided diff | Turn on auto-fix | Re-trigger cubic
…tters VulnScan cards now show the vuln count only for completed scans or scans that already recorded findings; in-progress, failed and DLQ'd scans with zero counts fall back to the bare repo name, as the bugs Scan card does. The Vuln card and show view reuse the bug linked-issue and fix-PR formatters (via a From<&VulnLinkedIssue> for LinkedIssue conversion), and the severity breakdown uses severity_label. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…visories Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
tjdammann
added a commit
that referenced
this pull request
Oct 30, 2026
Bumps the version so `release.yml` tags `v0.2.11` and cargo-dist builds and publishes the platform artifacts. Patch bump per the `cut-release` skill, which specifies patch unless a minor or major is explicitly requested. ### Since v0.2.10 - `feat(vulns): add read-only detail vulns command for security scan findings` (#339) — new `detail vulns list|show|scans` for security scan findings, mirroring `bugs list`/`show` and `scans list`, backed by the new `/public/v1/vulns*` endpoints. Also carried the quinn-proto, rustls, rustls-webpki and webpki-root-certs bumps for 11 RustSec advisories. - `chore: remove simulate_old_pagination test helper and its test` (#338) - `fix(bugs): clamp page on empty client-side filter results` (#335) ### Testing `cargo check`, `cargo fmt --check`, `cargo clippy -- -D warnings`, `cargo test` (348 lib + 18 integration), and `cargo xtask check` all pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- av pr metadata This information is embedded by the av CLI when creating PRs to track the status of stacks when using Aviator. Please do not delete or edit this section of the PR. ``` {"parent":"main","parentHead":"","trunk":"main"} ``` --> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a read-only
detail vulnscommand group for findings from Detail's security scans ("vulns"), modeled ondetail bugsanddetail scans. Findings have a severity instead of a priority and no review state, so there is noclose/reopen/prioritize.detail vulns list [repo]mirrorsbugs list:--severity critical|high|medium|low(repeatable or comma-separated, default all),--sort newest|oldest|severity(defaultnewest),--scan-id <wr_…>,--since/--until,--all,--limit(1–100, default 50),--page,--format table|json. Severity, sort and scan ID are filtered by the API.--alland the time window fetch every page and filter client-side, the same way bugs does.detail vulns show <ssf_…>mirrorsbugs show: ID, title, severity, file, created, commit, scan, linked issues and fix PR, then the markdown description rendered the same way as a bug summary.detail vulns scans [repo]mirrorsscans listfor security scans:--status,--since/--until,--limit,--page,--format. Cards show per-severity counts (e.g.14 High, 60 Medium, 412 Low) instead of open/dismissed/resolved.--format jsonall work as they do for the bugs commands.Other changes:
detail bugs list --vulnshelp text now says it filters bug-finder bugs flagged as security vulnerabilities, and points todetail vulns listfor security-scan findings.detail-bugs(installed bydetail skill) now has adetail vulnssection and says when to use it rather thanbugs list --vulns.docs/HELP.mdregenerated.Dependency
Depends on usedetail/detail#18482, which adds the public endpoints
GET /public/v1/vulns,GET /public/v1/vulns/{vuln_id}andGET /public/v1/vuln-scans.Warning
The
openapi.jsonin this PR was pulled from a local backend running #18482, not from prod, so the vendored-artifact CI step (cargo xtask check/ openapi check) will fail until #18482 is deployed to prod. After that,cargo xtask generate-openapishould produce an identical file. The file uses the same formatting as xtask: I checked that re-serializing the current file reproduces it byte-for-byte.Testing
cargo fmt --check,cargo clippy -- -D warnings,cargo test(345 unit tests, 18 integration) andcargo xtask check-helpall pass.--allconflicts, no mutating subcommands, JSON silencing). Integration help and no-auth tests now includevulns.usedetail/detail(515 vulns):vulns list: default view,--severity critical,high --sort severity,--scan-id(486 for the seeded scan),--all(515 of 515),--since 7d --until 1d, and an empty-window hint. Pagination totals were correct, and--format jsonoutput was valid.vulns show: a finding with a linked issue and a fix PR in both table and JSON output, plus one without a fix PR (fixPromitted).vulns scans: per-severity counts,--status/--sincefilters, and pagination.🤖 Generated with Claude Code