Skip to content
  • Jamie Tanna's avatar
    Introduce Advisories to track arbitrary package advisories · 60847228
    Jamie Tanna authored and Jamie Tanna's avatar Jamie Tanna committed
    As a way to provide a better means to annotate certain dependencies with
    information about why the package(s), or certain versions of a package
    must not be used, we can introduce the concept of Advisories.
    
    This produces a new table, `advisories`, that can be used to insert
    arbitrary advisories for package, such as "this package is no longer
    maintained" or "don't use this because of a security vulnerability".
    
    We can add a `db generate advisory` subcommand which can pre-seed with
    some community-provided package advisories, as an example of what can be
    done.
    
    We can use a more complicated query to perform this lookup using a
    `case / when` which allows us to perform more logic inside our query to
    look up the data, instead of performing the lookup in Go code.
    
    This uses an enum-style approach inside the database schema to provide a
    bit more control over the entries, as this is more likely to have custom
    SQL executed against it, so we want to make sur...
    60847228