fix: track UNKNOWN/LOW severity open vulns in health score v2 security pipeline (IN-1255) by gaspergrom · Pull Request #4533 · linuxfoundation/crowd.dev

gaspergrom · 2026-08-31T09:53:43Z

Summary

Fixes the open-vulnerability severity buckets in the health score v2 security pipeline: openModerates now includes LOW (was MEDIUM only), and a new openUnknowns bucket catches anything outside CRITICAL/HIGH/MEDIUM/LOW. Previously, open vulns with LOW or an unrecognized severity value fell through every bucket and were silently dropped from the count.
Change is threaded end-to-end through the pipe chain: health_score_v2_security.pipe/_ds → health_score_v2_signal_detail.pipe/_ds → project_insights_health_breakdown_copy.pipe → project_insights_health_breakdown_ds → project_insights_health_breakdown.pipe, so openUnknowns is available at every downstream consumption point, not just the source pipe.
Does not touch health_score_v2_lifecycle.pipe or health_score_v2_raw_inputs_snapshot.pipe — see follow-up note below.
Deploy ordering: this pipe change must be deployed to staging then production (via tb push + the scheduled copy run) before the companion insights PR (fix/IN-1255, same ticket) merges, since insights' getOpenVulnRow() reads the new openUnknowns field.

Known follow-up (out of scope for this PR)

health_score_v2_lifecycle.pipe and health_score_v2_raw_inputs_snapshot.pipe independently recompute open-severity vulnerability counts directly from the raw vulnerabilities table and have the same LOW/UNKNOWN blind spot described above. Not addressed here — tracked as a follow-up.

JIRA

IN-1255 — Fix open vulnerability count and scoring for unknown severity vulns

cursor · 2026-08-31T09:53:50Z

PR Summary

Medium Risk
Changes vulnerability counting and slightly shifts openVulnScore where LOW severities exist; schema/column additions require coordinated Tinybird deploy before downstream consumers.

Overview
Fixes open-vulnerability severity bucketing in Health Score v2 so LOW and non-standard severities are no longer dropped from analytics.

In health_score_v2_security.pipe, openModerates now counts MEDIUM and LOW (was MEDIUM only), so LOW findings contribute to the existing moderate penalty in openVulnScore. A new openUnknowns column counts open vulns whose severity is outside CRITICAL/HIGH/MEDIUM/LOW; it is surfaced through the pipeline but not wired into the score formula in this change.

openUnknowns is added to the related Tinybird datasources (health_score_v2_security_ds, health_score_v2_signal_detail_ds, project_insights_health_breakdown_ds) and propagated through health_score_v2_signal_detail, project/repo health breakdown copy pipes, and the project_insights_health_breakdown endpoint (max() rollup for project-level counts). Docs/comments reference IN-1255.

Deploy note: pipe/datasource changes should land before the companion insights PR that reads openUnknowns. health_score_v2_lifecycle / health_score_v2_raw_inputs_snapshot still use the old MEDIUM-only logic (called out as follow-up).

^{Reviewed by Cursor Bugbot for commit d02f663. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Pull request overview

Updates Health Score v2 to classify LOW and unknown-severity open vulnerabilities and expose them downstream.

Changes:

Groups LOW vulnerabilities with moderate severity.
Adds and propagates openUnknowns.
Exposes project-level unknown counts to Insights.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`services/libs/tinybird/pipes/health_score_v2_security.pipe`	Adds LOW/unknown severity buckets.
`services/libs/tinybird/datasources/health_score_v2_security_ds.datasource`	Stores unknown counts.
`services/libs/tinybird/pipes/health_score_v2_signal_detail.pipe`	Propagates unknown counts.
`services/libs/tinybird/datasources/health_score_v2_signal_detail_ds.datasource`	Adds the propagated field.
`services/libs/tinybird/pipes/project_insights_health_breakdown_copy.pipe`	Rolls up unknown counts.
`services/libs/tinybird/datasources/project_insights_health_breakdown_ds.datasource`	Stores project-level counts.
`services/libs/tinybird/pipes/project_insights_health_breakdown.pipe`	Exposes the field publicly.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…y pipeline (IN-1255) Widens openModerates to severity IN ('MEDIUM','LOW') and adds a new openUnknowns bucket (severity NOT IN the four known values), threaded through health_score_v2_security -> health_score_v2_signal_detail -> project_insights_health_breakdown(_copy) so open vulns of every severity land in exactly one bucket instead of LOW/UNKNOWN falling through unnoticed. Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

+                                countIf(
+                                    status = 'OPEN'
+                                    AND severity NOT IN ('CRITICAL', 'HIGH', 'MEDIUM', 'LOW')
+                                ) AS openUnknowns


cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 40408fb. Configure here.}

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (2)

services/libs/tinybird/pipes/health_score_v2_security.pipe:110

openUnknowns is exposed but never participates in openVulnScore: the formula above still subtracts only critical, high, and moderate counts. A repo whose only open vulnerabilities have UNKNOWN or another unrecognized severity therefore keeps a perfect score of 10, so the stated IN-1255 scoring fix is incomplete. Include this bucket in the formula using the intended penalty weight.

                        vc.openUnknowns AS openUnknowns,

services/libs/tinybird/pipes/health_score_v2_signal_detail.pipe:42

This datasource also feeds repo_health_score_v2_breakdown.pipe, but that request-time endpoint only rolls up openCriticals, openHighs, and openModerates (lines 60–65). Repo-filtered Overview responses will therefore omit openUnknowns while project-level responses include it, despite the end-to-end propagation claim. Add max(sd.openUnknowns) AS openUnknowns to the repo breakdown pipe too.

        s.openUnknowns AS openUnknowns,

… pipe Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

services/libs/tinybird/pipes/health_score_v2_security.pipe:110

openUnknowns is propagated, but the openVulnScore formula above still subtracts only critical, high, and moderate/low counts. A scanned repository containing only UNKNOWN or unrecognized severities therefore keeps a perfect vulnerability score of 10 and does not affect the overall security/health score, leaving the scoring part of IN-1255 unfixed. Apply the same one-point penalty used for LOW/MEDIUM unless the ticket specifies a different weight.

                        vc.openUnknowns AS openUnknowns,

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.

Suppressed comments (1)

services/libs/tinybird/pipes/health_score_v2_security.pipe:110

openUnknowns is propagated but never contributes to openVulnScore: the formula above still subtracts only critical, high, and moderate counts. A scanned repository containing only UNKNOWN vulnerabilities therefore keeps a perfect vulnerability score of 10, so the stated IN-1255 scoring fix is incomplete. Include this bucket in the score using the severity weight required by the ticket.

                        vc.openUnknowns AS openUnknowns,

Copilot AI balanced review requested due to automatic review settings August 31, 2026 09:53

Copilot started reviewing on behalf of gaspergrom August 31, 2026 09:54 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

gaspergrom force-pushed the fix/IN-1255-open-vuln-severity branch from e7072df to 40408fb Compare August 31, 2026 10:06

Copilot AI review requested due to automatic review settings August 31, 2026 10:06

Copilot started reviewing on behalf of gaspergrom August 31, 2026 10:06 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Comment thread services/libs/tinybird/pipes/health_score_v2_security.pipe

Comment on lines +184 to +187

countIf(

status = 'OPEN'

AND severity NOT IN ('CRITICAL', 'HIGH', 'MEDIUM', 'LOW')

) AS openUnknowns

Comment thread services/libs/tinybird/pipes/health_score_v2_signal_detail.pipe

cursor Bot reviewed Aug 31, 2026

View reviewed changes

Comment thread services/libs/tinybird/pipes/project_insights_health_breakdown.pipe

gaspergrom requested a review from joanagmaia August 31, 2026 12:46

chore: run tbf on health_score_v2_security.pipe IN-1255

fedfd9a

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot AI review requested due to automatic review settings August 31, 2026 12:46

Copilot started reviewing on behalf of gaspergrom August 31, 2026 12:47 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Merge branch 'main' into fix/IN-1255-open-vuln-severity

4afbc39

Copilot AI review requested due to automatic review settings August 31, 2026 16:16

Copilot started reviewing on behalf of gaspergrom August 31, 2026 16:17 View session

fix(review): propagate openUnknowns to repo_health_score_v2_breakdown…

9e49db8

… pipe Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Copilot AI reviewed Aug 31, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings August 31, 2026 16:19

Copilot started reviewing on behalf of gaspergrom August 31, 2026 16:19 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

joanagmaia approved these changes Aug 31, 2026

View reviewed changes

Merge branch 'main' into fix/IN-1255-open-vuln-severity

d02f663

Copilot AI review requested due to automatic review settings August 31, 2026 16:38

Copilot started reviewing on behalf of gaspergrom August 31, 2026 16:39 View session

Copilot AI reviewed Aug 31, 2026

View reviewed changes

gaspergrom merged commit 7ce6e6c into main Aug 31, 2026
16 checks passed

gaspergrom deleted the fix/IN-1255-open-vuln-severity branch August 31, 2026 16:44

Navigation Menu

Uh oh!

fix: track UNKNOWN/LOW severity open vulns in health score v2 security pipeline (IN-1255) - #4533

fix: track UNKNOWN/LOW severity open vulns in health score v2 security pipeline (IN-1255)#4533
gaspergrom merged 5 commits into
mainfrom
fix/IN-1255-open-vuln-severity

gaspergrom commented Aug 31, 2026

Uh oh!

cursor Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

gaspergrom commented Aug 31, 2026

Summary

Known follow-up (out of scope for this PR)

JIRA

Uh oh!

cursor Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cursor Bot commented Aug 31, 2026 •

edited

Loading