fix(vulnerabilities): coalesce summary and details for description field

[epipav]

Note

Low Risk
Low risk query change that only affects the description field returned by the vulnerabilities list, improving completeness when summary is null/empty. Potential impact is limited to downstream consumers expecting description to be strictly the summary text.

Overview
Updates the Tinybird vulnerabilities_list pipe so the description field is now populated via coalesce(any(v.summary), any(v.details)), falling back to details when a summary is unavailable.

This changes the data returned for some vulnerability rows (previously description could be null even when details existed) without altering filtering, grouping, or pagination logic.

^{Written by Cursor Bugbot for commit cce226f. This will update automatically on new commits. Configure here.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

coalesce never falls back because column is non-nullable

High Severity

coalesce(any(v.summary), any(v.details)) will never fall back to v.details because the summary column is defined as a non-nullable String with DEFAULT '' in the datasource. The any() aggregate on a non-nullable string column returns '' (not NULL) when the value is empty, and coalesce only substitutes NULL values. The fallback is effectively dead code. Something like nullIf would be needed to convert empty strings to NULL before coalesce can work as intended.

 

[Copilot]

Pull request overview

This PR updates the Tinybird vulnerabilities_list pipe to populate the description field by falling back to details when summary is missing, improving robustness of vulnerability descriptions in list responses.

Changes:

• Update description selection to coalesce summary and details in the vulnerabilities list query.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

any() is non-deterministic across rows in the group. Using coalesce(any(v.summary), any(v.details)) can pick summary from one row and details from another, or fall back to details even when a non-null summary exists in a different row within the same (vulnerabilityId, packageName) group. To keep the coalescing per-row and then aggregate consistently, apply coalesce before the aggregate (e.g., aggregate any(coalesce(v.summary, v.details)) or an equivalent deterministic aggregate).

Suggested change

	coalesce(any (v.summary), any (v.details)) as description,
	any(coalesce(v.summary, v.details)) as description,