formula: render vulnerabilities from the API JSON

[andrew]

Shows a Known vulnerabilities table on the formula page when _data/formula/<name>.json carries vulnerabilities.open, and a Homebrew ships patches for line when vulnerabilities.patched is non-empty. Nothing is rendered for formulae without the field.

The field is populated by brew generate-formula-api from Homebrew/advisory-database's data/advisories.json (Homebrew/brew#23341, Homebrew/advisory-database#30). Each entry links its first upstream id (or the BREW-* id when there is none) to https://osv.dev/vulnerability/<id> with severity and truncated summary.

Rendered output for a fixture with two open (one CVE-linked, one without) and one patched:

<p>Known vulnerabilities in the current version:</p>
<table class="full-width"><tr>
    <td><a rel="nofollow" href="https://osv.dev/vulnerability/CVE-2024-1111">CVE-2024-1111</a> (high)</td>
    <td>Something bad</td>
</tr><tr>
    <td><a rel="nofollow" href="https://osv.dev/vulnerability/BREW-testvuln-CPANSA-X">BREW-testvuln-CPANSA-X</a></td>
    <td>No CVE</td>
</tr></table>
<p><small>Data from <a href="https://github.com/Homebrew/advisory-database">Homebrew/advisory-database</a>. Run <code>brew vulns testvuln</code> for a live check.</small></p>
<p>Homebrew ships patches for: <a rel="nofollow" href="https://osv.dev/vulnerability/CVE-2014-0001">CVE-2014-0001</a>.</p>

Safe to merge before Homebrew/brew#23341: the field is absent until that lands, so both blocks are skipped.

[Copilot]

Pull request overview

Adds rendering of vulnerability information from the formula API JSON onto the formula detail page, surfacing both currently open vulnerabilities and vulnerabilities patched by Homebrew when present in _data/formula/<name>.json.

Changes:

• Render a “Known vulnerabilities” table when f.vulnerabilities.open is non-empty.
• Render a “Homebrew ships patches for” line when f.vulnerabilities.patched is non-empty.
• Link vulnerability IDs to OSV and display severity + a truncated summary.

Comments suppressed due to low confidence (1)

_layouts/formula.html:283

• Same issue as the open block: f.vulnerabilities may be missing, so f.vulnerabilities.patched.size > 0 can error during rendering. Guard for f.vulnerabilities and check against empty.

{%- if f.vulnerabilities.patched.size > 0 %}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[p-linnane]

🚀