[GSoC] EPSS History(Chart+Table) by Samk1710 · Pull Request #2328 · aboutcode-org/vulnerablecode

Samk1710 · 2026-06-07T17:58:09Z

Resolves

Add a historical chart to visualize EPSS score trends over time #2231

Tasks Done:

add Trend Line Chart for EPSS History Visualization (Billboard.js)
add History Table paginated over 30 dates per page

Test log excerpt:

Updating is_latest on existing V2 Advisory.
System check identified no issues (0 silenced).
.
----------------------------------------------------------------------
Ran 1 test in 0.440s

OK
Destroying test database for alias 'default'...

Billboard links:

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com> Refactor css for tooltip Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Samk1710 · 2026-06-07T18:31:30Z

Attached the following screenshots as reference:

Note:

In this screenshot, my local postgres has EPSS scores imported from May 30th to June 7th. However, I intentionally skipped importing data for June 4th and June 5th to simulate an import failure or missing upstream data which was a concern in the community call. To address this, I made sure the chart functions as a discrete representation rather than drawing misleading, continuous trend lines as seen in the graph.

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

pombredanne · 2026-06-17T07:26:35Z

@tdruez your input is welcomed on the choice of billboard.js (vs. libraries already in use in ScanCode.io?)

tdruez · 2026-06-17T07:46:55Z

@pombredanne We use billboard.js in SCIO as well.

pombredanne

@Samk1710 Thanks... you'll need to resolve merge conflicts. And here are a few things to review.

pombredanne · 2026-06-17T07:27:52Z

@@ -0,0 +1,58 @@
+import json


Please add the copyright and license header

pombredanne · 2026-06-17T07:29:19Z

+        cves = {
+            alias_obj.alias
+            for alias_obj in advisory.aliases.all()
+            if alias_obj.alias.startswith("CVE-")


Why this check on the prefix? Is there a better way?

pombredanne · 2026-06-17T07:30:05Z

+            for alias_obj in advisory.aliases.all()
+            if alias_obj.alias.startswith("CVE-")
+        }
+        if advisory.advisory_id and advisory.advisory_id.startswith("CVE-"):


Why again the same check?

pombredanne · 2026-06-17T07:31:29Z

+        ref_obj = AdvisoryReference.objects.create(url=json_data[0]["references"][0]["url"])
+
+        for i, data in enumerate(json_data):
+            is_latest = i == 0


not sure I get what this means: this would be true only on the 1st iteration, and is_latest seems to say the opposite?

pombredanne · 2026-06-17T07:32:23Z

+
+            advisory.references.add(ref_obj)
+
+            severity = data["severities"][0]


could you instead iterate on severities? this would be cleaner IMHO.

pombredanne · 2026-06-17T07:46:32Z

+        const data = getHistoryData();
+        if (!data.length) return;
+
+        toggleDisplay(chartWrap);


what is chartwrap? and tablewrap?

pombredanne · 2026-06-17T07:47:19Z

+        if (chartWrap.style.display === "none" || epssChartInstance) return;
+
+        const history = [];
+        const map = new Map(data.map(h => [new Date(h.published_at + "T00:00:00").setHours(0,0,0,0), h]));


What does this variable contain? map feels a pretty non descriptive name.

pombredanne · 2026-06-17T07:49:02Z

+        const history = [];
+        const map = new Map(data.map(h => [new Date(h.published_at + "T00:00:00").setHours(0,0,0,0), h]));
+
+        const end = new Date(data[data.length - 1].published_at + "T00:00:00").setHours(0,0,0,0);


I would prefer that all these data handling and data preparation happen in Python and not here in the JS code.

pombredanne · 2026-06-17T08:51:45Z

@@ -0,0 +1,13 @@
+about_resource: billboard-3.18.0.pkgd.min.js


Please also include the non-minified version... also the js is NOT part of the zip you list at all, but part of the npm at https://registry.npmjs.org/billboard.js/-/billboard.js-3.18.0.tgz instead. Please use that version, not some random thing fetched from a CDN.

Also where is d3 coming from in all this?

The minified JS bundles D3... Is this really a good thing?

Copyright (c) 2017 ~ present NAVER Corp.

billboard.js project is licensed under the MIT license

billboard.js, JavaScript chart library

https://naver.github.io/billboard.js/

@Version 3.18.0

All-in-one packaged file for ease use of 'billboard.js' with dependant d3.js modules & polyfills.

@types/d3-selection ^3.0.11

@types/d3-transition ^3.0.9

d3-axis ^3.0.0

d3-brush ^3.0.0

d3-drag ^3.0.0

d3-dsv ^3.0.1

d3-ease ^3.0.1

d3-hierarchy ^3.1.2

d3-interpolate ^3.0.1

d3-scale ^4.0.2

d3-selection ^3.0.0

d3-shape ^3.2.0

d3-time-format ^4.1.0

d3-transition ^3.0.1

d3-zoom ^3.0.0

pombredanne · 2026-06-17T09:00:26Z


 # editors
 .vscode
+*.code-workspace


what is this?

Samk1710 added 5 commits June 2, 2026 01:40

Add EPSS insights(trend line and history table)

dbb396b

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Add tests for EPSS insights

604bf6f

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Add pagination to epss history

31a2417

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Fix import order

a178cbb

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Refactor css for tooltip

e1dd885

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com> Refactor css for tooltip Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Samk1710 mentioned this pull request Jun 7, 2026

History of Advisories #2329

Open

Samk1710 added 2 commits June 11, 2026 00:50

Fix See Trend and See Table on EPSS tab

7a3ecff

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Store billboard.js locally and add respective licenses

3f78bc9

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

pombredanne requested changes Jun 17, 2026

View reviewed changes


		advisory.references.add(ref_obj)

		severity = data["severities"][0]

		@@ -0,0 +1,13 @@
		about_resource: billboard-3.18.0.pkgd.min.js

Uh oh!

Conversation

Samk1710 commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Samk1710 commented Jun 7, 2026

Uh oh!

pombredanne commented Jun 17, 2026

Uh oh!

tdruez commented Jun 17, 2026

Uh oh!

pombredanne left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Samk1710 commented Jun 7, 2026 •

edited

Loading