[GSoC] EPSS History(Chart+Table) by Samk1710 · Pull Request #2328 · aboutcode-org/vulnerablecode

Samk1710 · 2026-06-07T17:58:09Z

Resolves

Add a historical chart to visualize EPSS score trends over time #2231

Tasks Done:

add Trend Line Chart for EPSS History Visualization (Billboard.js)
add History Table paginated over 30 dates per page

Test log excerpt:

Updating is_latest on existing V2 Advisory.
System check identified no issues (0 silenced).
.
----------------------------------------------------------------------
Ran 1 test in 0.440s

OK
Destroying test database for alias 'default'...

Billboard links:

Samk1710 · 2026-06-07T18:31:30Z

Attached the following screenshots as reference:

Note:

In this screenshot, my local postgres has EPSS scores imported from May 30th to June 7th. However, I intentionally skipped importing data for June 4th and June 5th to simulate an import failure or missing upstream data which was a concern in the community call. To address this, I made sure the chart functions as a discrete representation rather than drawing misleading, continuous trend lines as seen in the graph.

pombredanne · 2026-06-17T07:26:35Z

@tdruez your input is welcomed on the choice of billboard.js (vs. libraries already in use in ScanCode.io?)

tdruez · 2026-06-17T07:46:55Z

@pombredanne We use billboard.js in SCIO as well.

pombredanne

@Samk1710 Thanks... you'll need to resolve merge conflicts. And here are a few things to review.

pombredanne · 2026-06-17T07:29:19Z

+        cves = {
+            alias_obj.alias
+            for alias_obj in advisory.aliases.all()
+            if alias_obj.alias.startswith("CVE-")


Why this check on the prefix? Is there a better way?

I think a better way would be how the EPSS score is fetched. I followed that. See:

vulnerablecode/vulnerabilities/views.py

Line 679 in 4702c06

datasource_id=EPSSImporterPipeline.pipeline_id

pombredanne · 2026-06-17T07:30:05Z

+            for alias_obj in advisory.aliases.all()
+            if alias_obj.alias.startswith("CVE-")
+        }
+        if advisory.advisory_id and advisory.advisory_id.startswith("CVE-"):


Why again the same check?

I have removed the alias check now after clarifying it on slack.

https://aboutcode-org.slack.com/archives/C0A9H7AGCSJ/p1781805921752269

pombredanne · 2026-06-17T07:31:29Z

+        ref_obj = AdvisoryReference.objects.create(url=json_data[0]["references"][0]["url"])
+
+        for i, data in enumerate(json_data):
+            is_latest = i == 0


not sure I get what this means: this would be true only on the 1st iteration, and is_latest seems to say the opposite?

Yes. The first item in the test data is the latest one.

https://github.com/Samk1710/vulnerablecode/blob/b60b3f550f1f5a30b96796f3a1ca6c65d2b35099/vulnerabilities/tests/test_data/epss/epss_history_test_data.json#L20

pombredanne · 2026-06-17T07:32:23Z

+
+            advisory.references.add(ref_obj)
+
+            severity = data["severities"][0]


could you instead iterate on severities? this would be cleaner IMHO.

pombredanne · 2026-06-17T07:46:32Z

+        const data = getHistoryData();
+        if (!data.length) return;
+
+        toggleDisplay(chartWrap);


what is chartwrap? and tablewrap?

these are the DOM containers for the chart and table. I actually renamed them to containers now, hope that's easier to read.

pombredanne · 2026-06-17T08:51:45Z

@@ -0,0 +1,13 @@
+about_resource: billboard-3.18.0.pkgd.min.js


Please also include the non-minified version... also the js is NOT part of the zip you list at all, but part of the npm at https://registry.npmjs.org/billboard.js/-/billboard.js-3.18.0.tgz instead. Please use that version, not some random thing fetched from a CDN.

Also where is d3 coming from in all this?

The minified JS bundles D3... Is this really a good thing?

Copyright (c) 2017 ~ present NAVER Corp.

billboard.js project is licensed under the MIT license

billboard.js, JavaScript chart library

https://naver.github.io/billboard.js/

@Version 3.18.0

All-in-one packaged file for ease use of 'billboard.js' with dependant d3.js modules & polyfills.

@types/d3-selection ^3.0.11

@types/d3-transition ^3.0.9

d3-axis ^3.0.0

d3-brush ^3.0.0

d3-drag ^3.0.0

d3-dsv ^3.0.1

d3-ease ^3.0.1

d3-hierarchy ^3.1.2

d3-interpolate ^3.0.1

d3-scale ^4.0.2

d3-selection ^3.0.0

d3-shape ^3.2.0

d3-time-format ^4.1.0

d3-transition ^3.0.1

d3-zoom ^3.0.0

I have added the un-minfied bundles for billboard and d3. Should we also change https://github.com/aboutcode-org/scancode.io/blob/main/scancodeio/static/billboard-3.0.1.pkgd.min.js ?

Samk1710 · 2026-06-17T20:54:56Z

@Samk1710 Thanks... you'll need to resolve merge conflicts. And here are a few things to review.

Thanks @pombredanne for the review. I will go through all your comments and update shortly.

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com> Refactor css for tooltip Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Samk1710 · 2026-06-20T17:09:23Z

@Samk1710 Thanks... you'll need to resolve merge conflicts. And here are a few things to review.

Thanks @pombredanne for the review. I will go through all your comments and update shortly.

Rebased and updated as per the review comments. Do let me know if it needs further improvement. @pombredanne

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Samk1710 mentioned this pull request Jun 7, 2026

History of Advisories #2329

Open

pombredanne requested changes Jun 17, 2026

View reviewed changes

Samk1710 added 8 commits June 20, 2026 18:16

Add EPSS insights(trend line and history table)

ff85262

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Add tests for EPSS insights

7b3d28c

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Add pagination to epss history

8b4b089

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Fix import order

11da055

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Refactor css for tooltip

554fa25

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com> Refactor css for tooltip Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Fix See Trend and See Table on EPSS tab

feb0c13

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Store billboard.js locally and add respective licenses

a24cd32

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Update with un-minified billboard.js and d3.js and liceneses

8115908

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Samk1710 force-pushed the gsoc-epss-history branch from 3f78bc9 to b60b3f5 Compare June 20, 2026 16:28

Refactor to get_epss_history and update tests

2dec56f

Signed-off-by: Sampurna Pyne <sampurnapyne1710@gmail.com>

Samk1710 force-pushed the gsoc-epss-history branch from b60b3f5 to 2dec56f Compare June 20, 2026 17:16


		advisory.references.add(ref_obj)

		severity = data["severities"][0]

		@@ -0,0 +1,13 @@
		about_resource: billboard-3.18.0.pkgd.min.js

Uh oh!

Conversation

Samk1710 commented Jun 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Samk1710 commented Jun 7, 2026

Uh oh!

pombredanne commented Jun 17, 2026

Uh oh!

tdruez commented Jun 17, 2026

Uh oh!

pombredanne left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Samk1710 commented Jun 17, 2026

Uh oh!

Samk1710 commented Jun 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Samk1710 commented Jun 7, 2026 •

edited

Loading