ROX-35970: Add CVE Origin UI by dcaravel · Pull Request #22464 · stackrox/stackrox

dcaravel · 2026-08-26T02:22:27Z

Description

Adds new CVE Origin field to the single image and deployment pages. The field is added to the aggregate CVE rows as well as individual component rows.

Also adds severity and CVSS columns to the image component rows.

The origin field is conditional on Scanner V4 being enabled (similar to EPSS).

User-facing documentation

CHANGELOG.md is updated OR update is not needed
documentation PR is created and is linked above OR is not needed

Testing and quality

the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
CI results are inspected

Automated testing

added unit tests

How I validated my change

CI + Manual testing

Image page:

Deployment Page:

Info Popover:

CVE Origin column is hidden when Scanner V4 Disabled:

openshift-ci · 2026-08-26T02:22:30Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-08-26T02:28:13Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3dbc845a-4356-476e-941f-8a971a13e3d6

📥 Commits

Reviewing files that changed from the base of the PR and between 858456a and e9c0856.

📒 Files selected for processing (2)

ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.test.ts
ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

Summary by CodeRabbit

New Features
- Added CVE origin information to image and deployment vulnerability tables.
- Added CVSS scores, score versions, severity details, and origin labels to image component findings.
- Added version-aware help text explaining CVE origins.
Enhancements
- CVE origin columns are shown or hidden based on Scanner V4 availability.
- Origin values are aggregated across related components, including “Multiple” and “Other” labels.
Bug Fixes
- Improved consistency of vulnerability details and table row formatting across views.

Walkthrough

The vulnerability tables now retrieve CVSS, score version, and CVE origin data. They render origin values for image and deployment vulnerabilities. ROX_SCANNER_V4 controls origin-column visibility in page-level tables.

Changes

CVE origin support

Layer / File(s)	Summary
Origin mapping and documentation `ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts`, `ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.test.ts`, `ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/infoForTh.tsx`	Adds origin label mapping, aggregation behavior, tests, and versioned CVE origin information.
Table data and origin aggregation `ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/table.utils.ts`	Adds CVSS, score version, and origin fields to table data. Deployment rows aggregate component origins.
Deployment vulnerability tables `ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/Deployment*`	Adds CVE origin retrieval, headers, cells, tooltips, and Dockerfile-layer span updates.
Image vulnerability tables `ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Tables/Image*`	Adds CVSS, severity, and CVE origin retrieval and rendering. Image rows aggregate component origins.
Feature-flag column wiring `ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Deployment/DeploymentPageVulnerabilities.tsx`, `ui/apps/platform/src/Containers/Vulnerabilities/WorkloadCves/Image/ImagePageVulnerabilities.tsx`	Hides the origin column when `ROX_SCANNER_V4` is disabled.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to e9c08

This feature-gated UI change has no identified merge-blocking correctness or operational risk at the current head and is merge-ready after normal checks.

Suggested reviewers: alanonthegit, alwayshooin, bradr5

Sequence Diagram(s)

sequenceDiagram
  participant VulnerabilityGraphQL
  participant tableUtils
  participant VulnerabilityTable
  participant PageFeatureFlags
  VulnerabilityGraphQL->>tableUtils: Return CVSS, scoreVersion, and origin
  tableUtils->>tableUtils: Aggregate and format origin values
  tableUtils->>VulnerabilityTable: Provide vulnerability rows
  PageFeatureFlags->>VulnerabilityTable: Set origin-column visibility
  VulnerabilityTable->>VulnerabilityTable: Render CVE origin

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 7.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 14 functions across 10 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: adding CVE Origin UI support.
Description check	✅ Passed	The description covers the change scope, feature-flag gating, documentation status, testing status, CI inspection, and manual validation with screenshots. It does not list every automated-test categor…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description covers the change scope, feature-flag gating, documentation status, testing status, CI inspection, and manual validation with screenshots. It does not list every automated-test category from the template, but the relevant testing information is sufficient.

Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dc/cve-origin-ui-display

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-26T02:31:10Z

🚀 Build Images Ready

Images are ready for commit f3f3b37. To use with deploy scripts:

export MAIN_IMAGE_TAG=5.0.x-92-gf3f3b37bba

codecov · 2026-08-26T02:47:02Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 51.30%. Comparing base (df7fd00) to head (e9c0856).
⚠️ Report is 25 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #22464      +/-   ##
==========================================
- Coverage   51.42%   51.30%   -0.12%     
==========================================
  Files        2869     2871       +2     
  Lines      179875   179881       +6     
==========================================
- Hits        92492    92286     -206     
- Misses      79286    79502     +216     
+ Partials     8097     8093       -4

Flag	Coverage Δ
go-unit-tests	`51.30% <ø> (-0.12%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

dcaravel · 2026-08-26T12:50:34Z

/retest

dvail

Two comments, mostly nits and non-blocking. LGTM!

dcaravel added 5 commits August 25, 2026 21:16

add cve origin to image/deployment singles pages

2d3d563

make origin field conditional on scanner v4 being enabled

0f0f201

add severity and cvss to image component table

5b57946

add info popover

5497a88

move origin col after affected components

858456a

openshift-ci Bot added the do-not-merge/work-in-progress label Aug 26, 2026

github-actions Bot added the area/ui label Aug 26, 2026

dcaravel changed the title ~~ROX-35970: Add UI CVE Origin + Severity and CVSS to image components~~ ROX-35970: Add CVE Origin UI Aug 26, 2026

dcaravel marked this pull request as ready for review August 26, 2026 02:35

dcaravel requested a review from a team as a code owner August 26, 2026 02:35

openshift-ci Bot removed the do-not-merge/work-in-progress label Aug 26, 2026

dcaravel requested a review from dvail August 26, 2026 02:35

dvail approved these changes Aug 26, 2026

View reviewed changes

Comment thread ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts

Comment thread ui/apps/platform/src/Containers/Vulnerabilities/utils/vulnerabilityUtils.ts Outdated

address review comments

e9c0856

dcaravel added the auto-retest PRs with this label will be automatically retested if prow checks fails label Aug 26, 2026

dcaravel merged commit f3f3b37 into master Aug 26, 2026
114 of 115 checks passed

dcaravel deleted the dc/cve-origin-ui-display branch August 26, 2026 22:20

dcaravel mentioned this pull request Aug 26, 2026

ROX-36498: Add CVE Origin filter to UI #22488

Merged

4 tasks done

charmik-redhat pushed a commit that referenced this pull request Aug 27, 2026

ROX-35970: Add CVE Origin UI (#22464)

9d16832

dcaravel added a commit that referenced this pull request Oct 1, 2026

ROX-35970: Add CVE Origin UI (#22464)

3f8ed1f

dcaravel mentioned this pull request Oct 1, 2026

ROX-37300: Backport CVE Origin display, reporting, and filtering #23175

Open

2 of 6 tasks

Navigation Menu

ROX-35970: Add CVE Origin UI - #22464

ROX-35970: Add CVE Origin UI#22464
dcaravel merged 6 commits into
masterfrom
dc/cve-origin-ui-display

dcaravel commented Aug 26, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

dcaravel commented Aug 26, 2026

Uh oh!

dvail left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dcaravel commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

User-facing documentation

Testing and quality

Automated testing

How I validated my change

Uh oh!

openshift-ci Bot commented Aug 26, 2026

Uh oh!

coderabbitai Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

codecov Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dcaravel commented Aug 26, 2026

Uh oh!

dvail left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dcaravel commented Aug 26, 2026 •

edited

Loading

coderabbitai Bot commented Aug 26, 2026 •

edited

Loading

github-actions Bot commented Aug 26, 2026 •

edited

Loading

codecov Bot commented Aug 26, 2026 •

edited

Loading