🔒 Security Advisory Models

Structures in pkg/domain that describe Packagist security advisories. They correspond to Packagist's https://packagist.org/api/security-advisories/ API endpoints and are deserialized by ComposerClient.GetSecurityAdvisories / GetSecurityAdvisoriesForPackages / GetSecurityAdvisoriesSince.

Type Overview

Type	Role
AdvisoriesResponse	Top-level response, advisory mapping grouped by package name
Advisory	Single security advisory details
Source	Advisory source (GitHub, NVD, etc.)

---

🛡️ AdvisoriesResponse

Top-level structure for security advisory responses. Advisories is a map where keys are package names and values are lists of advisories for that package.

type AdvisoriesResponse struct {
    Advisories map[string][]*Advisory `json:"advisories"`
}

Field	Type	Description
Advisories	map[string][]*Advisory	Security advisory mapping, key is package name (e.g., symfony/http-foundation), value is the list of security advisories for that package

Typical JSON form

{
  "advisories": {
    "symfony/http-foundation": [
      {"advisoryId": "PKSA-38s9-s9dj", "packageName": "symfony/http-foundation", ...}
    ]
  }
}

---

🐞 Advisory

Single security advisory, containing vulnerability identifier, affected scope, source, and timing.

type Advisory struct {
    AdvisoryID         string    `json:"advisoryId"`
    PackageName        string    `json:"packageName"`
    RemoteID           string    `json:"remoteId"`
    Title              string    `json:"title"`
    Link               string    `json:"link"`
    Cve                string    `json:"cve"`
    AffectedVersions   string    `json:"affectedVersions"`
    Source             string    `json:"source"`
    ReportedAt         string    `json:"reportedAt"`
    ComposerRepository string    `json:"composerRepository"`
    Sources            []*Source `json:"sources"`
}

Field	Type	Description	Example
AdvisoryID	string	Packagist advisory unique identifier	PKSA-38s9-s9dj
PackageName	string	Affected Composer package name	symfony/http-foundation
RemoteID	string	ID in remote system	CVE-2022-24894
Title	string	Advisory title	HTTP Request Smuggling in Symfony HttpFoundation
Link	string	Advisory detail link	https://github.com/advisories/GHSA-rc93-5vf2-xh7q
Cve	string	CVE number	CVE-2022-24894
AffectedVersions	string	Affected version range (Composer version constraint syntax)	>=5.4.0,<5.4.19|>=6.0.0,<6.0.4
Source	string	Source platform	GitHub
ReportedAt	string	Report time (ISO 8601 string)	2022-03-10T12:00:00Z
ComposerRepository	string	Related Composer repository	packagist
Sources	[]*Source	Multiple source information list	See next section

AffectedVersions uses pipe to separate multiple constraints

AffectedVersions is a Composer version constraint string where multiple segments are separated by | (e.g., >=5.4.0,<5.4.19|>=6.0.0,<6.0.4). When checking whether a specific version is affected, use Composer's version constraint parser instead of simple string comparison.

---

🌐 Source

Advisory source information, possibly from different security databases.

type Source struct {
    Name     string `json:"name"`
    RemoteID string `json:"remoteId"`
}

Field	Type	Description	Example
Name	string	Source name	GitHub, NVD
RemoteID	string	Remote ID in source platform	GHSA-rc93-5vf2-xh7q

---

🚀 Example: Fetch and Iterate Security Advisories

package main

import (
    "fmt"
    "log"
    "time"

    "github.com/scagogogo/composer-skills/pkg/client"
)

func main() {
    c := client.NewComposerClient(60 * time.Second)

    // Fetch security advisories for specified packages
    resp, err := c.GetSecurityAdvisoriesForPackages([]string{"symfony/http-foundation", "guzzlehttp/guzzle"})
    if err != nil {
        log.Fatal(err)
    }

    for pkg, advisories := range resp.Advisories {
        fmt.Printf("=== %s (%d advisories) ===\n", pkg, len(advisories))
        for _, a := range advisories {
            fmt.Printf("  [%s] %s\n", a.Cve, a.Title)
            fmt.Printf("    Affected versions: %s\n", a.AffectedVersions)
            fmt.Printf("    Reported at:       %s\n", a.ReportedAt)
            fmt.Printf("    Link:              %s\n", a.Link)
        }
    }
}

Incremental fetch by time

For security monitoring, use GetSecurityAdvisoriesSince(updatedSince time.Time) to fetch only advisories updated after a specific time point, suitable for scheduled polling scenarios.

📚 Related Documentation

• 🔙 Back to Domain Overview
• 📦 Package detail fields → package.md
• 📊 Change tracking → statistics.md