feat: add advisories pagination (CM-1283)

[ulemons]

Summary

Adds page and pageSize query parameters to GET /api/v1/akrites/packages/advisories. Previously the endpoint returned all advisories for a package in a single response (up to 700+ for some packages), with no way to page through results.

Changes

• getPackageAdvisories.ts — accepts page (default 1) and pageSize (default 20, max 100) query params via Zod schema; response now includes page, pageSize, total alongside advisories
• api.ts (DAL) — getAdvisoriesByPackageId now accepts optional opts: { page, pageSize }:
  • when provided: runs paginated SELECT + COUNT(*) in parallel, returns { rows, total }
  • when omitted (used by getPackage.ts detail view): returns all rows, derives total from rows.length — skips the extra COUNT query
• openapi.yaml — documents page and pageSize parameters and updated response schema

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1283

---

Note

Medium Risk
Public API contract changes: advisories are paginated by default (breaking for clients that expected the full list), and Advisory adds required isCritical plus severity enum moderate instead of medium.

Overview
Adds pagination and filtering to GET /akrites/packages/advisories so the Security tab can load advisories in chunks instead of returning hundreds in one response. The handler now accepts page (default 1) and pageSize (default 20, max 100), plus optional severity, resolution, and critical filters (comma-separated or repeated query params). Responses include page, pageSize, and total alongside advisories.

getAdvisoriesByPackageId in the DAL was refactored around a CTE that computes resolution and isCritical from advisories.is_critical, applies filters, orders by severity/resolution/osvId, and runs a separate COUNT when pagination opts are passed. When opts are omitted (package detail), it still returns all rows and skips the count query.

Advisory objects now require isCritical (CVSS ≥ 7.0) on both the advisories endpoint and package detail security.advisories. OpenAPI updates severity to moderate (was medium), documents resolution as open | patched, and describes the new query params.

normalizePurl replaces the qualifier-stripping regex with an explicit stripQualifiers helper (same normalization behavior).

^{Reviewed by Cursor Bugbot for commit 43f9058. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds pagination support to the Akrites “package advisories” listing endpoint to avoid returning hundreds of advisories in a single response, while keeping the package detail endpoint behavior unchanged.

Changes:

• Add page (default 1) and pageSize (default 20, max 100) query params to the advisories endpoint, and return { page, pageSize, total, advisories }.
• Update DAL getAdvisoriesByPackageId to optionally paginate and return { rows, total }, while retaining a non-paginated mode for package detail.
• Update Akrites OpenAPI to document new query params and response shape.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
services/libs/data-access-layer/src/osspckgs/api.ts	Extends DAL advisories query to support optional pagination + total count.
backend/src/api/public/v1/packages/getPackageAdvisories.ts	Validates pagination via Zod and returns paginated response metadata.
backend/src/api/public/v1/packages/getPackage.ts	Adapts to new DAL return shape while still embedding full advisories list.
backend/src/api/public/v1/akrites/openapi.yaml	Documents the new pagination parameters and updated 200-response schema.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 43f9058. Configure here.}