You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
General edits:
- Identify "we" as the AboutCode team
- Shorter sentences with active voice
- Avoid dependent clauses to start sentences
- Remove unnecessary adverbs
Signed-off-by: Michael Herzog <mjherzog@aboutcode.org>
Copy file name to clipboardExpand all lines: website/blog/vcio-migration-announcement-aboutcode/vcio-migration-announcement-aboutcode.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,23 +8,23 @@ hide_table_of_contents: false
8
8
9
9
# VulnerableCode API Deprecation and V3 Introduction
10
10
11
-
VulnerableCode (public.vulnerablecode.io) is planning to deprecate V1 and V2 API by the end of Q2 2026 (June 20, 2026) with the V3 API and UI to be introduced by the end of January 2026.
11
+
The AboutCode team is planning to deprecate the V1 and V2 API of VulnerableCode (public.vulnerablecode.io) by the end of Q2 2026 (June 20, 2026). We are introducing V3 API and UI by the end of January 2026.
12
12
13
13
---
14
14
15
15
## Why this new API
16
16
17
-
The existing V1 and V2 APIs are both based on the “vulnerabilities” model, designed to aggregate information from multiple advisory sources based on identifiers and aliases. Due to the combination of various sources, it is difficult to determine which source is correct and this may result in data from one source overwriting data from another source.
17
+
The existing V1 and V2 APIs are both based on the “vulnerabilities” model, designed to aggregate information from multiple advisory sources based on identifiers and aliases. With the "vulnerabilities" model it is difficult to determine which source is correct because of the combination of sources. This may result in data from one source overwriting data from another source.
18
18
19
19
---
20
20
21
-
## What to expect from this new API and UI
21
+
## What to expect from the new V3 API and UI
22
22
23
23
Moving forward, VulnerableCode will report “advisories” for packages and not “vulnerabilities”.
24
24
25
25
Currently if a package has 4 advisories and those 4 advisories were correlated with each other by their aliases and identifiers, we report a single vulnerability affecting that package. The new approach in V3 will report 4 individual advisories.
26
26
27
-
The new “advisories” model introduces an Advisory ID (AVID) for each advisory in VulnerableCode. An AVID will have different components like the source and the natural unique identifier used at that source. So for example if we are importing an advisory from “nodejs_security_wg” and it’s identified by its ID “123”, the AVID will be “nodejs_security_wg/123”.
27
+
The new “advisories” model introduces an Advisory ID (AVID) for each advisory in VulnerableCode. An AVID will have different components like the source and the natural unique identifier used at that source. For example if we are importing an advisory from “nodejs_security_wg” and it’s identified by its ID “123”, the AVID will be “nodejs_security_wg/123”.
28
28
29
29
---
30
30
@@ -40,7 +40,7 @@ We are planning to complete the following tasks by the end of January 2026:
40
40
41
41
## Current Status
42
42
43
-
https://public2.vulnerablecode.io/v2 uses the new advisory based UI and
43
+
https://public2.vulnerablecode.io/v2 uses the new advisory based UI
44
44
https://public2.vulnerablecode.io/api/v3/ uses new API, but it is still under development and not ready for production use.
0 commit comments