feat: [asset] Add highest_upgradable_cve_severity field to Vulnerability report (#6589)

gcf-owl-bot[bot] · leahecole · web-flow · commit 830c73ae0482 · 2025-08-11T20:25:18.000-04:00
* feat: Add highest_upgradable_cve_severity field to Vulnerability report docs: A comment for field `update_time` in message `.google.cloud.osconfig.v1.VulnerabilityReport` is changed docs: A comment for field `filter` in message `.google.cloud.osconfig.v1.ListVulnerabilityReportsRequest` is changed PiperOrigin-RevId: 792763000 Source-Link: googleapis/googleapis@eef0d65 Source-Link: googleapis/googleapis-gen@8a589ca Copy-Tag: eyJwIjoicGFja2FnZXMvZ29vZ2xlLWNsb3VkLWFzc2V0Ly5Pd2xCb3QueWFtbCIsImgiOiI4YTU4OWNhYzYxZGEwYjZkZmQ0YmQwZGE5OGViNDBjMzc2OWY5ZGFkIn0= * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com> Co-authored-by: Leah E. Cole <6719667+leahecole@users.noreply.github.com>
diff --git a/packages/google-cloud-asset/protos/google/cloud/osconfig/v1/vulnerability.proto b/packages/google-cloud-asset/protos/google/cloud/osconfig/v1/vulnerability.proto
@@ -130,18 +130,54 @@ message VulnerabilityReport {
     repeated Item items = 6;
   }
 
+  // Severity levels for vulnerabilities.
+  enum VulnerabilitySeverityLevel {
+    // Default SeverityLevel. This value is unused.
+    VULNERABILITY_SEVERITY_LEVEL_UNSPECIFIED = 0;
+
+    // Vulnerability has no severity level.
+    NONE = 1;
+
+    // Vulnerability severity level is minimal. This is level below the low
+    // severity level.
+    MINIMAL = 2;
+
+    // Vulnerability severity level is low. This is level below the medium
+    // severity level.
+    LOW = 3;
+
+    // Vulnerability severity level is medium. This is level below the high
+    // severity level.
+    MEDIUM = 4;
+
+    // Vulnerability severity level is high. This is level below the critical
+    // severity level.
+    HIGH = 5;
+
+    // Vulnerability severity level is critical. This is the highest severity
+    // level.
+    CRITICAL = 6;
+  }
+
   // Output only. The `vulnerabilityReport` API resource name.
   //
   // Format:
   // `projects/{project_number}/locations/{location}/instances/{instance_id}/vulnerabilityReport`
   string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
 
   // Output only. List of vulnerabilities affecting the VM.
-  repeated Vulnerability vulnerabilities = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
-
-  // Output only. The timestamp for when the last vulnerability report was generated for the
-  // VM.
-  google.protobuf.Timestamp update_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+  repeated Vulnerability vulnerabilities = 2
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The timestamp for when the last vulnerability report was
+  // generated for the VM.
+  google.protobuf.Timestamp update_time = 3
+      [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. Highest level of severity among all the upgradable
+  // vulnerabilities with CVEs attached.
+  VulnerabilitySeverityLevel highest_upgradable_cve_severity = 4
+      [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
 // A request message for getting the vulnerability report for the specified VM.
@@ -185,8 +221,22 @@ message ListVulnerabilityReportsRequest {
   // should continue from.
   string page_token = 3;
 
-  // If provided, this field specifies the criteria that must be met by a
-  // `vulnerabilityReport` API resource to be included in the response.
+  // This field supports filtering by the severity level for the vulnerability.
+  // For a list of severity levels, see [Severity levels for
+  // vulnerabilities](https://cloud.google.com/container-analysis/docs/container-scanning-overview#severity_levels_for_vulnerabilities).
+  //
+  // The filter field follows the rules described in the
+  // [AIP-160](https://google.aip.dev/160) guidelines as follows:
+  //
+  // + **Filter for a specific severity type**:  you can list reports that
+  // contain
+  // vulnerabilities that are classified as medium by specifying
+  // `vulnerabilities.details.severity:MEDIUM`.
+  //
+  // + **Filter for a range of severities** : you can list reports that have
+  // vulnerabilities that are classified as critical or high by specifying
+  // `vulnerabilities.details.severity:HIGH OR
+  // vulnerabilities.details.severity:CRITICAL`
   string filter = 4;
 }
 
