{# Server tab "vulnerabilities": OSV findings for the installed packages. Context: s, vulns (services.vulns.summary), user, csrf #}
{% set v = vulns %}
<div class="grid g4" style="margin-bottom:16px">
  <div class="stat"><div class="k">Critical</div><div class="v" style="color:{% if v.counts.critical %}var(--err){% else %}var(--text){% endif %}">{{ v.counts.critical }}</div></div>
  <div class="stat"><div class="k">High</div><div class="v" style="color:{% if v.counts.high %}var(--err){% else %}var(--text){% endif %}">{{ v.counts.high }}</div></div>
  <div class="stat"><div class="k">Medium</div><div class="v" style="color:{% if v.counts.medium %}var(--warn){% else %}var(--text){% endif %}">{{ v.counts.medium }}</div></div>
  <div class="stat"><div class="k">Low / unknown</div><div class="v">{{ v.counts.low + v.counts.unknown }}</div><div class="t">{{ v.packages }} packages{% if v.osv_ecosystem %} · {{ v.osv_ecosystem }}{% endif %}</div></div>
</div>
<div class="panel" style="margin-bottom:16px;padding:12px 16px"><div class="hdr" style="margin:0;align-items:center">
  <div class="small muted">Last scan: {% if v.scanned_at %}{{ v.scanned_at|timeago }} ({{ v.scanned_at|dt }}){% else %}not yet{% if v.inventory and v.inventory.changed_at %} — queued, the worker scans within a minute{% endif %}{% endif %}{% if v.error %} · <span class="warn">{{ v.error }}</span>{% endif %} · source <a href="https://osv.dev" target="_blank" rel="noopener">OSV.dev</a> · rescans when the package list changes and every 7 days.
    {% if v.runtimes %}<div style="margin-top:4px"><b>Runtimes:</b> {% for k, val in v.runtimes.items() %}<span class="tag">{{ k }} {{ val }}</span>{% endfor %}</div>{% endif %}</div>
  {% if user.can_edit %}<form method="post" action="/app/servers/{{ s.id }}/vulns/rescan" class="inline"><input type="hidden" name="csrf" value="{{ csrf }}"><button class="btn sm">Rescan</button></form>{% endif %}
</div></div>
{% if not v.inventory or not v.packages %}
<div class="panel"><h3>No package inventory yet</h3><p class="small muted" style="margin:0">Agent 1.2+ sends the installed package list (dpkg / apk / rpm) once a day and whenever it changes; Vigil matches every package version against the OSV.dev database (Debian, Ubuntu, Alpine, Rocky/Alma advisories) and lists what needs updating. Make sure "Send package inventory" is on under Alert rules → Logs &amp; inventory.</p></div>
{% elif not v.vulns %}
<div class="panel"><p class="ok" style="margin:0">No known vulnerabilities in the {{ v.packages }} installed packages{% if v.scanned_at %} (scanned {{ v.scanned_at|timeago }}){% endif %}.</p></div>
{% else %}
<div class="panel tight tbl"><table><thead><tr><th>Severity</th><th>Package</th><th>Installed → fixed</th><th>Advisory</th><th>Summary</th><th>Seen</th></tr></thead><tbody>
  {% for x in v.vulns %}
  <tr><td><span class="pill {% if x.severity in ('critical','high') %}err{% elif x.severity == 'medium' %}warn{% elif x.severity == 'low' %}info{% endif %}">{{ x.severity }}</span></td>
    <td class="mono small"><b>{{ x.package }}</b></td>
    <td class="mono xs">{{ x.version }}{% if x.fixed_version %} → <span class="ok">{{ x.fixed_version }}</span>{% else %} <span class="dim">(no fix yet)</span>{% endif %}</td>
    <td class="small"><a href="https://osv.dev/vulnerability/{{ x.vuln_id }}" target="_blank" rel="noopener">{{ x.vuln_id }}</a>{% if x.published %}<div class="xs dim">{{ x.published.strftime('%Y-%m-%d') }}</div>{% endif %}</td>
    <td class="small" style="max-width:480px">{{ (x.summary or '')[:220] }}{% if x.summary and x.summary|length > 220 %}…{% endif %}</td>
    <td class="xs dim" style="white-space:nowrap">{{ x.first_seen|timeago }}</td></tr>
  {% endfor %}
</tbody></table></div>
<p class="small muted" style="margin-top:10px">Fix: <code class="k">apt upgrade &lt;package&gt;</code> / <code class="k">apk upgrade</code> / <code class="k">dnf update</code>; entries disappear on the next inventory change. An incident opens when new critical vulnerabilities appear.</p>
{% endif %}