Updating the application

To update Vulnerability-Lookup, run:

$ cd vulnerability-lookup/
$ poetry run update

During the update process, you will be prompted to back up the PostgreSQL database. If you prefer to trigger the backup manually, use:

$ poetry run flask --app website.app db_backup

The update also applies the pending database migrations and seeds any missing RBAC roles, permissions, and policies. When upgrading an instance that predates the RBAC system, see Migrating an existing instance for what the migration does and how to verify it.

Updating the Kvrocks indexes

If you need to rebuild the Kvrocks indexes, run:

$ cd vulnerability-lookup/
$ poetry run python bin/index_vulnerabilities.py
$ poetry run python bin/index_cwe.py

index_vulnerabilities re-derives every index and counter from the stored records. It also prunes ids that survive in a source’s updated index without a stored record (leftovers of deletions that predate the index cleanup on delete), which otherwise inflate the entry count of /recent for that source. Pass --source <name> (repeatable) to limit the rebuild to one source.

Migrating GNA records to the amended GCVE-BCP-05 identifier placement

GCVE-BCP-05, as amended in September 2026, puts a record’s identifier in the vulnId of its single recordType: advisory entry of containers.cna.x_gcve. Records stored before that carry it only in the legacy cveMetadata.vulnId; they are still read, but the BCP-03 dumps generated from them keep publishing the legacy shape. Complete them once, after updating:

$ poetry run backfill_gcve_vulnid --dry-run
$ poetry run backfill_gcve_vulnid

The command covers every gna-* source, this instance’s own GNA included (--source <name> limits it), and only adds the missing advisory entry: the legacy field, the dates and the indexes are left as they are, so peers do not re-pull the records and nobody is notified. Records whose identifier placements disagree are listed for review instead of being rewritten.