Package responses currently embed every advisory associated with the package. For SBOM enrichment (and the version endpoint generally) it's more useful to return only the advisories whose affected ranges include the requested version.
Proposed: on version responses and version-aware PURL lookup (#1184), include an advisories array filtered to entries where the version falls inside an affected range. Each entry carries the advisory identifiers, whether this version is affected or fixed, and the fixed version(s) if known.
The unfiltered list stays on the package resource for callers that want everything.
Related: CISA 2026 SBOM minimum elements asks for component-level vulnerability data tied to the exact version, not the package.
Package responses currently embed every advisory associated with the package. For SBOM enrichment (and the version endpoint generally) it's more useful to return only the advisories whose affected ranges include the requested version.
Proposed: on version responses and version-aware PURL lookup (#1184), include an
advisoriesarray filtered to entries where the version falls inside an affected range. Each entry carries the advisory identifiers, whether this version is affected or fixed, and the fixed version(s) if known.The unfiltered list stays on the package resource for callers that want everything.
Related: CISA 2026 SBOM minimum elements asks for component-level vulnerability data tied to the exact version, not the package.