Repository navigation
fedcode-next: Extract fix commits from pull requests and issues body or comments in search for CVE-related messages #2002
Description
Implement a pipeline that extracts fix commits from pull requests, issue descriptions, and comments.
The pipeline should search for vulnerability-related messages and security fix indicators using, for example, the GitHub or GitLab API.
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
- Status
Activity
ziadhany commentedon Apr 9, 2026
@TG1999 @keshav-space
These PRs need to be reviewed so we can close this issue. once you have a time, please take a look:
TG1999 commentedon Apr 10, 2026
@ziadhany aboutcode-data/vulnerablecode-vcs-collector#1 this need tests, on package-url/packageurl-python#223 there are already some comments by Philippe, please coordinate on resolving them first
ziadhany commentedon May 15, 2026
This is done, now we can collect issues and PRs in Github and Gitlab. We have a new project named vulnerablecode-vcs-collector at https://github.com/aboutcode-data/vulnerablecode-vcs-collector that is designed to collect fix commits from VCS histories
This has been merged with:
The current implementation works from hardcoded list of packages. The future improvements will drive that directly from PURLs collected in a CVE or driven from the larger PurlDB. These future improvements are tracked in a separate issue: