tracker_service: make unimportant issues non-red

They were marked as red and 'vulnerable'. Since they are marked as unimportant, we should show that to not raise alarms.

https://lists.debian.org/debian-lts/2023/06/msg00064.html

added 1 commit

• 70915776 - tracker_service: make unimportant issues non-red

Compare with previous version

@jmm since you wrote the above mail, can you take a quick look at this? It will change the table in e.g. [1] and make the status 'unimportant' and switch status and version to yellow.

[1] https://security-tracker.debian.org/tracker/CVE-2023-31147

Looks good, but we could even go one step further and simply print them in black like the rest?

In theory they are still affecting the source, so I personally would prefer one similar to the original proposal, indicating with both a different (light) color and an annotation that they are with a negligible impact or a non-issue.

But the current patch only changes the colour of the "Version" column to yellow and keeps the status as "Vulnerable", that still indicates some action is needed, while in reality there isn't. In the example of CVE-2023-31147 really needs to be fixed on released suites. "Fixing" this would only introduce churn/risk of regression for no gain.

If we move to "Version" == yellow and also changing the status to "non issue/no impact" that would be fine.

It's marking both the version and the status as yellow. But I'll change the status wording to vulnerable (unimportant)

added 107 commits

• 70915776...ff3cbf06 - 106 commits from branch security-tracker-team:master
• 05e8e523 - tracker_service: make unimportant issues non-red

Compare with previous version

Looks good to me

approved this merge request

Looks good to me, thank you @pochu (and @jmm)

merged

mentioned in commit 6331de58