Updating the application

Updating the application#

$ cd vulnerability-lookup/
$ poetry run update

The script asks before each step. Add --yes to run them all without asking.

It will:

  1. pull the latest code and submodules (if the update script itself changed, it stops: run it again);

  2. install the Python and frontend dependencies (poetry install, npm ci --omit=dev);

  3. validate and update the configuration files;

  4. rebuild the documentation;

  5. if user accounts are enabled (user_accounts in config/generic.json):

    • update the MISP warning lists, the GCVE registry and the list of coordinated assigners;

    • back up the PostgreSQL database, then apply the database migrations;

    • add the missing RBAC roles, permissions and policies;

  6. restart the services (with systemd if the service is active, otherwise with poetry run stop and poetry run start).

To back up the database by hand:

$ poetry run flask --app website.app db_backup

Upgrading an instance from before the RBAC system? See Migrating an existing instance.

Updating the CWE catalogue#

CWE 5.0 / schema 8 support includes groupings, views, and the expanded history and lifecycle fields. The next cwec feeder cycle automatically refreshes an already imported release once; existing vulnerability mappings are retained. See CWE catalogue for API compatibility details and manual refresh.

Rebuilding the Kvrocks indexes#

$ poetry run index_vulnerabilities
$ poetry run index_cwe

index_vulnerabilities rebuilds every index and counter from the stored records, and removes ids left in an index without a stored record.

  • --source <name> (repeatable) limits it to some sources. Use the stored source name, not the feeder’s section in modules.cfg (see “Source names” in Prepared statistics figures).

  • --purge also rebuilds the shared sets (vendors, products, assigners, links) from scratch. It always covers every source.

The same pass prepares the figures served by /api/stats/*. Re-run it after an upgrade that adds a figure: until then, that figure answers available: false. Schedule it in cron with the other statistics jobs: see Prepared statistics figures.

Migrating GNA records to the amended GCVE-BCP-05#

Since September 2026, GCVE-BCP-05 puts a record’s identifier in the vulnId of its recordType: advisory entry in containers.cna.x_gcve. Older records only have the legacy cveMetadata.vulnId. They are still read, but their dumps keep the old shape. Complete them once, after updating:

$ poetry run backfill_gcve_vulnid --dry-run
$ poetry run backfill_gcve_vulnid

It covers every gna-* source (--source <name> to limit it) and only adds the missing advisory entry. Nothing else changes, so peers do not re-pull the records and nobody is notified. Records with conflicting identifiers are listed for review, not rewritten.