From c7ecab95b8396f46c90cfdaea10262d9e094e65f Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 14:09:45 +0400
Subject: [PATCH 01/19] add detected_date on
 AffectedByVulnerabilityRelationship

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 ...ected_date_to_affected_by_vulnerability.py | 43 +++++++++++++++++++
 vulnerabilities/models.py                     |  8 ++++
 2 files changed, 51 insertions(+)
 create mode 100644 component_catalog/migrations/0014_add_detected_date_to_affected_by_vulnerability.py

diff --git a/component_catalog/migrations/0014_add_detected_date_to_affected_by_vulnerability.py b/component_catalog/migrations/0014_add_detected_date_to_affected_by_vulnerability.py
new file mode 100644
index 00000000..a790c3f6
--- /dev/null
+++ b/component_catalog/migrations/0014_add_detected_date_to_affected_by_vulnerability.py
@@ -0,0 +1,43 @@
+# Generated by Django 6.0 on 2026-07-20
+
+import django.utils.timezone
+from django.db import migrations
+from django.db import models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("component_catalog", "0013_package_package_content"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="componentaffectedbyvulnerability",
+            name="detected_date",
+            field=models.DateTimeField(
+                auto_now_add=True,
+                default=django.utils.timezone.now,
+                help_text=(
+                    "Date and time when this vulnerability was first detected on this object. "
+                    "Used to measure how long a vulnerability has remained unaddressed. "
+                    "Defaults to the time the record was created."
+                ),
+            ),
+            preserve_default=False,
+        ),
+        migrations.AddField(
+            model_name="packageaffectedbyvulnerability",
+            name="detected_date",
+            field=models.DateTimeField(
+                auto_now_add=True,
+                default=django.utils.timezone.now,
+                help_text=(
+                    "Date and time when this vulnerability was first detected on this object. "
+                    "Used to measure how long a vulnerability has remained unaddressed. "
+                    "Defaults to the time the record was created."
+                ),
+            ),
+            preserve_default=False,
+        ),
+    ]
diff --git a/vulnerabilities/models.py b/vulnerabilities/models.py
index 0c82ee21..b0d25a84 100644
--- a/vulnerabilities/models.py
+++ b/vulnerabilities/models.py
@@ -393,6 +393,14 @@ class AffectedByVulnerabilityRelationship(DataspacedModel):
         to="vulnerabilities.Vulnerability",
         on_delete=models.CASCADE,
     )
+    detected_date = models.DateTimeField(
+        auto_now_add=True,
+        help_text=_(
+            "Date and time when this vulnerability was first detected on this object. "
+            "Used to measure how long a vulnerability has remained unaddressed. "
+            "Defaults to the time the record was created."
+        ),
+    )
 
     class Meta:
         abstract = True

From 5ee2ceac6002f5ea0c18dc90bc760af3f9d8d401 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 14:19:41 +0400
Subject: [PATCH 02/19] add new VulnerabilityDetectedRule

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/policy/rules.py b/policy/rules.py
index bc89931c..ca4051ce 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -6,8 +6,12 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
+
 from django.apps import apps
 
+# VulnerabilityAnalysis states that indicate a vulnerability has been triaged and addressed.
+TERMINAL_VULNERABILITY_STATES = ["resolved", "resolved_with_pedigree", "not_affected"]
+
 
 class BaseRule:
     """Base class for policy rule handlers."""
@@ -100,10 +104,39 @@ class LicenseCoverageGapRule(PackageBaseRule):
     package_filter = {"license_expression": ""}
 
 
+class VulnerabilityDetectedRule(BaseRule):
+    rule_type = "vulnerability_detected"
+    label = "Vulnerability Detected"
+    severity = "error"
+    description = "Detects packages with at least one known vulnerability (non-null risk score)."
+    parameters_schema = {
+        "min_risk_score": "Minimum risk score (0.0-10.0). Default: any vulnerability.",
+    }
+
+    def get_package_filter(self):
+        return {"package__risk_score__isnull": False}
+
+    def count_violations(self, product, threshold, parameters):
+        Package = apps.get_model("component_catalog", "package")
+
+        packages = Package.objects.filter(
+            productpackages__product=product,
+            risk_score__isnull=False,
+        )
+
+        min_risk_score = parameters.get("min_risk_score")
+        if min_risk_score is not None:
+            packages = packages.filter(risk_score__gte=min_risk_score)
+
+        count = packages.count()
+        return count if count > threshold else 0
+
+
 RULE_REGISTRY = {
     UsagePolicyErrorRule.rule_type: UsagePolicyErrorRule(),
     UsagePolicyWarningRule.rule_type: UsagePolicyWarningRule(),
     LicensePolicyErrorRule.rule_type: LicensePolicyErrorRule(),
     LicensePolicyWarningRule.rule_type: LicensePolicyWarningRule(),
     LicenseCoverageGapRule.rule_type: LicenseCoverageGapRule(),
+    VulnerabilityDetectedRule.rule_type: VulnerabilityDetectedRule(),
 }

From e0018cc4adcc40498946115adcfe3141b6aba863 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 15:48:48 +0400
Subject: [PATCH 03/19] add UnresolvedVulnerabilityCountRule

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/policy/rules.py b/policy/rules.py
index ca4051ce..63594c0c 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -8,6 +8,8 @@
 
 
 from django.apps import apps
+from django.db.models import Exists
+from django.db.models import OuterRef
 
 # VulnerabilityAnalysis states that indicate a vulnerability has been triaged and addressed.
 TERMINAL_VULNERABILITY_STATES = ["resolved", "resolved_with_pedigree", "not_affected"]
@@ -132,6 +134,41 @@ def count_violations(self, product, threshold, parameters):
         return count if count > threshold else 0
 
 
+class UnresolvedVulnerabilityCountRule(BaseRule):
+    rule_type = "unresolved_vulnerability_count"
+    label = "Unresolved Vulnerability Count"
+    severity = "warning"
+    description = (
+        "Counts individual package-vulnerability links in the product that have not been "
+        "addressed via a VulnerabilityAnalysis with a terminal state "
+        "(resolved, resolved_with_pedigree, or not_affected)."
+    )
+
+    def count_violations(self, product, threshold, parameters):
+        PackageAffectedByVulnerability = apps.get_model(
+            "component_catalog", "packageaffectedbyvulnerability"
+        )
+        VulnerabilityAnalysis = apps.get_model("vulnerabilities", "vulnerabilityanalysis")
+
+        terminal_analysis = VulnerabilityAnalysis.objects.filter(
+            product=product,
+            state__in=TERMINAL_VULNERABILITY_STATES,
+            package=OuterRef("package"),
+            vulnerability=OuterRef("vulnerability"),
+        )
+
+        count = (
+            PackageAffectedByVulnerability.objects.filter(
+                package__productpackages__product=product,
+            )
+            .annotate(has_terminal_analysis=Exists(terminal_analysis))
+            .filter(has_terminal_analysis=False)
+            .distinct()
+            .count()
+        )
+        return count if count > threshold else 0
+
+
 RULE_REGISTRY = {
     UsagePolicyErrorRule.rule_type: UsagePolicyErrorRule(),
     UsagePolicyWarningRule.rule_type: UsagePolicyWarningRule(),
@@ -139,4 +176,5 @@ def count_violations(self, product, threshold, parameters):
     LicensePolicyWarningRule.rule_type: LicensePolicyWarningRule(),
     LicenseCoverageGapRule.rule_type: LicenseCoverageGapRule(),
     VulnerabilityDetectedRule.rule_type: VulnerabilityDetectedRule(),
+    UnresolvedVulnerabilityCountRule.rule_type: UnresolvedVulnerabilityCountRule(),
 }

From c7e97657e2f5b70a1b7a4e12e7a97ea9fefe962f Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 16:00:40 +0400
Subject: [PATCH 04/19] add Stale Vulnerability rule

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py | 55 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/policy/rules.py b/policy/rules.py
index 63594c0c..7ccd3d7e 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -6,10 +6,12 @@
 # See https://aboutcode.org for more information about AboutCode FOSS projects.
 #
 
+from datetime import timedelta
 
 from django.apps import apps
 from django.db.models import Exists
 from django.db.models import OuterRef
+from django.utils import timezone
 
 # VulnerabilityAnalysis states that indicate a vulnerability has been triaged and addressed.
 TERMINAL_VULNERABILITY_STATES = ["resolved", "resolved_with_pedigree", "not_affected"]
@@ -169,6 +171,58 @@ def count_violations(self, product, threshold, parameters):
         return count if count > threshold else 0
 
 
+class StaleVulnerabilityRule(BaseRule):
+    rule_type = "stale_vulnerability"
+    label = "Stale Vulnerability"
+    severity = "error"
+    description = (
+        "Detects packages with a high-risk vulnerability that has remained unaddressed "
+        "beyond a configured delay. The delay is measured from the detected_date on the "
+        "package-vulnerability link, i.e. when the vulnerability was first imported for "
+        "that specific package."
+    )
+    parameters_schema = {
+        "max_days": (
+            "Maximum number of days a vulnerability may remain unaddressed before flagging. "
+            "Default: 30."
+        ),
+        "min_risk_score": (
+            "Only consider vulnerabilities with at least this risk score. Default: 8.0."
+        ),
+    }
+
+    def count_violations(self, product, threshold, parameters):
+        PackageAffectedByVulnerability = apps.get_model(
+            "component_catalog", "packageaffectedbyvulnerability"
+        )
+        VulnerabilityAnalysis = apps.get_model("vulnerabilities", "vulnerabilityanalysis")
+
+        max_days = parameters.get("max_days", 30)
+        min_risk_score = parameters.get("min_risk_score", 8.0)
+        cutoff_date = timezone.now() - timedelta(days=max_days)
+
+        terminal_analysis = VulnerabilityAnalysis.objects.filter(
+            product=product,
+            state__in=TERMINAL_VULNERABILITY_STATES,
+            package=OuterRef("package"),
+            vulnerability=OuterRef("vulnerability"),
+        )
+
+        count = (
+            PackageAffectedByVulnerability.objects.filter(
+                package__productpackages__product=product,
+                vulnerability__risk_score__gte=min_risk_score,
+                detected_date__lte=cutoff_date,
+            )
+            .annotate(has_terminal_analysis=Exists(terminal_analysis))
+            .filter(has_terminal_analysis=False)
+            .values("package_id")
+            .distinct()
+            .count()
+        )
+        return count if count > threshold else 0
+
+
 RULE_REGISTRY = {
     UsagePolicyErrorRule.rule_type: UsagePolicyErrorRule(),
     UsagePolicyWarningRule.rule_type: UsagePolicyWarningRule(),
@@ -177,4 +231,5 @@ def count_violations(self, product, threshold, parameters):
     LicenseCoverageGapRule.rule_type: LicenseCoverageGapRule(),
     VulnerabilityDetectedRule.rule_type: VulnerabilityDetectedRule(),
     UnresolvedVulnerabilityCountRule.rule_type: UnresolvedVulnerabilityCountRule(),
+    StaleVulnerabilityRule.rule_type: StaleVulnerabilityRule(),
 }

From f55e9bd0d3d62c58b7ea8d548ed029f98f5bfbe5 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 17:33:59 +0400
Subject: [PATCH 05/19] add unit test for the new rules

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 dje/models.py              |   1 +
 policy/tests/test_rules.py | 250 +++++++++++++++++++++++++++++++++++++
 2 files changed, 251 insertions(+)
 create mode 100644 policy/tests/test_rules.py

diff --git a/dje/models.py b/dje/models.py
index 996195ce..259a980b 100644
--- a/dje/models.py
+++ b/dje/models.py
@@ -1143,6 +1143,7 @@ def get_exclude_candidates_fields(self):
                 field.related_model is Dataspace,
                 isinstance(field, models.AutoField),
                 isinstance(field, models.UUIDField),
+                getattr(field, "auto_now_add", False) or getattr(field, "auto_now", False),
                 not field.null and not field.blank and not field.has_default(),
                 field.name in ALWAYS_EXCLUDE,
             ]
diff --git a/policy/tests/test_rules.py b/policy/tests/test_rules.py
new file mode 100644
index 00000000..596f70b4
--- /dev/null
+++ b/policy/tests/test_rules.py
@@ -0,0 +1,250 @@
+#
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# DejaCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: AGPL-3.0-only
+# See https://github.com/aboutcode-org/dejacode for support or download.
+# See https://aboutcode.org for more information about AboutCode FOSS projects.
+#
+
+from datetime import timedelta
+
+from django.contrib.contenttypes.models import ContentType
+from django.test import TestCase
+from django.utils import timezone
+
+from component_catalog.models import Package
+from component_catalog.models import PackageAffectedByVulnerability
+from component_catalog.tests import make_package
+from dje.models import Dataspace
+from license_library.models import License
+from license_library.tests import make_license
+from policy.models import UsagePolicy
+from policy.rules import LicenseCoverageGapRule
+from policy.rules import LicensePolicyErrorRule
+from policy.rules import LicensePolicyWarningRule
+from policy.rules import StaleVulnerabilityRule
+from policy.rules import UnresolvedVulnerabilityCountRule
+from policy.rules import UsagePolicyErrorRule
+from policy.rules import UsagePolicyWarningRule
+from policy.rules import VulnerabilityDetectedRule
+from product_portfolio.tests import make_product
+from product_portfolio.tests import make_product_package
+from vulnerabilities.tests import make_vulnerability
+from vulnerabilities.tests import make_vulnerability_analysis
+
+
+class UsagePolicyErrorRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+        self.policy = UsagePolicy.objects.create(
+            label="Prohibited",
+            icon="icon",
+            content_type=ContentType.objects.get_for_model(Package),
+            compliance_alert=UsagePolicy.Compliance.ERROR,
+            dataspace=self.dataspace,
+        )
+
+    def test_counts_packages_with_error_usage_policy(self):
+        package = make_package(self.dataspace, usage_policy=self.policy)
+        make_product_package(self.product, package=package)
+        make_product_package(self.product, package=make_package(self.dataspace))
+        count = UsagePolicyErrorRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+    def test_returns_zero_when_no_matching_packages(self):
+        make_product_package(self.product, package=make_package(self.dataspace))
+        count = UsagePolicyErrorRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+
+class UsagePolicyWarningRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+        self.policy = UsagePolicy.objects.create(
+            label="Restricted",
+            icon="icon",
+            content_type=ContentType.objects.get_for_model(Package),
+            compliance_alert=UsagePolicy.Compliance.WARNING,
+            dataspace=self.dataspace,
+        )
+
+    def test_counts_packages_with_warning_usage_policy(self):
+        package = make_package(self.dataspace, usage_policy=self.policy)
+        make_product_package(self.product, package=package)
+        count = UsagePolicyWarningRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+
+class LicensePolicyErrorRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+        self.policy = UsagePolicy.objects.create(
+            label="Prohibited",
+            icon="icon",
+            content_type=ContentType.objects.get_for_model(License),
+            compliance_alert=UsagePolicy.Compliance.ERROR,
+            dataspace=self.dataspace,
+        )
+
+    def test_counts_packages_with_license_error_policy(self):
+        license_ = make_license(self.dataspace, key="gpl-3.0", usage_policy=self.policy)
+        package = make_package(self.dataspace)
+        package.licenses.add(license_, through_defaults={"dataspace": self.dataspace})
+        make_product_package(self.product, package=package)
+        count = LicensePolicyErrorRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+    def test_returns_zero_when_license_has_no_policy(self):
+        license_ = make_license(self.dataspace, key="mit")
+        package = make_package(self.dataspace)
+        package.licenses.add(license_, through_defaults={"dataspace": self.dataspace})
+        make_product_package(self.product, package=package)
+        count = LicensePolicyErrorRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+
+class LicensePolicyWarningRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+        self.policy = UsagePolicy.objects.create(
+            label="Restricted",
+            icon="icon",
+            content_type=ContentType.objects.get_for_model(License),
+            compliance_alert=UsagePolicy.Compliance.WARNING,
+            dataspace=self.dataspace,
+        )
+
+    def test_counts_packages_with_license_warning_policy(self):
+        license_ = make_license(self.dataspace, key="lgpl-2.1", usage_policy=self.policy)
+        package = make_package(self.dataspace)
+        package.licenses.add(license_, through_defaults={"dataspace": self.dataspace})
+        make_product_package(self.product, package=package)
+        count = LicensePolicyWarningRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+
+class LicenseCoverageGapRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+
+    def test_counts_packages_with_no_license_expression(self):
+        make_product_package(
+            self.product, package=make_package(self.dataspace, license_expression="")
+        )
+        make_product_package(
+            self.product, package=make_package(self.dataspace, license_expression="mit")
+        )
+        count = LicenseCoverageGapRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+    def test_returns_zero_when_all_packages_have_license(self):
+        make_product_package(
+            self.product, package=make_package(self.dataspace, license_expression="mit")
+        )
+        count = LicenseCoverageGapRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+
+class VulnerabilityDetectedRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+
+    def test_counts_packages_with_any_vulnerability(self):
+        package = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=package, risk_score=5.0)
+        make_product_package(self.product, package=package)
+        make_product_package(self.product, package=make_package(self.dataspace))
+        count = VulnerabilityDetectedRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+    def test_min_risk_score_excludes_packages_below_threshold(self):
+        package = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=package, risk_score=4.0)
+        make_product_package(self.product, package=package)
+        count = VulnerabilityDetectedRule().count_violations(
+            self.product, 0, {"min_risk_score": 7.0}
+        )
+        self.assertEqual(0, count)
+
+    def test_min_risk_score_includes_packages_at_or_above_threshold(self):
+        package = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=package, risk_score=9.0)
+        make_product_package(self.product, package=package)
+        count = VulnerabilityDetectedRule().count_violations(
+            self.product, 0, {"min_risk_score": 7.0}
+        )
+        self.assertEqual(1, count)
+
+
+class UnresolvedVulnerabilityCountRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+
+    def test_counts_unanalyzed_package_vulnerability_links(self):
+        package = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=package)
+        make_product_package(self.product, package=package)
+        count = UnresolvedVulnerabilityCountRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+    def test_does_not_count_links_with_terminal_analysis(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package)
+        product_package = make_product_package(self.product, package=package)
+        make_vulnerability_analysis(product_package, vulnerability, state="resolved")
+        count = UnresolvedVulnerabilityCountRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+
+class StaleVulnerabilityRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+
+    def test_counts_old_unresolved_high_risk_links(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package, risk_score=9.0)
+        make_product_package(self.product, package=package)
+        old_date = timezone.now() - timedelta(days=60)
+        PackageAffectedByVulnerability.objects.filter(
+            package=package, vulnerability=vulnerability
+        ).update(detected_date=old_date)
+        count = StaleVulnerabilityRule().count_violations(self.product, 0, {})
+        self.assertEqual(1, count)
+
+    def test_does_not_count_recent_links(self):
+        package = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=package, risk_score=9.0)
+        make_product_package(self.product, package=package)
+        count = StaleVulnerabilityRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+    def test_does_not_count_links_below_min_risk_score(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package, risk_score=3.0)
+        make_product_package(self.product, package=package)
+        old_date = timezone.now() - timedelta(days=60)
+        PackageAffectedByVulnerability.objects.filter(
+            package=package, vulnerability=vulnerability
+        ).update(detected_date=old_date)
+        count = StaleVulnerabilityRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+    def test_does_not_count_stale_links_with_terminal_analysis(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package, risk_score=9.0)
+        product_package = make_product_package(self.product, package=package)
+        old_date = timezone.now() - timedelta(days=60)
+        PackageAffectedByVulnerability.objects.filter(
+            package=package, vulnerability=vulnerability
+        ).update(detected_date=old_date)
+        make_vulnerability_analysis(product_package, vulnerability, state="resolved")
+        count = StaleVulnerabilityRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)

From cb8f916e65c105f3d3eddefab7a74ab2862cec0b Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 17:39:46 +0400
Subject: [PATCH 06/19] add model migration

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 ...ctaffectedbyvulnerability_detected_date.py | 20 +++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 product_portfolio/migrations/0019_productaffectedbyvulnerability_detected_date.py

diff --git a/product_portfolio/migrations/0019_productaffectedbyvulnerability_detected_date.py b/product_portfolio/migrations/0019_productaffectedbyvulnerability_detected_date.py
new file mode 100644
index 00000000..74e8ee2e
--- /dev/null
+++ b/product_portfolio/migrations/0019_productaffectedbyvulnerability_detected_date.py
@@ -0,0 +1,20 @@
+# Generated by Django 6.0.6 on 2026-07-22 13:35
+
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('product_portfolio', '0018_productpolicyviolation'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='productaffectedbyvulnerability',
+            name='detected_date',
+            field=models.DateTimeField(auto_now_add=True, default=django.utils.timezone.now, help_text='Date and time when this vulnerability was first detected on this object. Used to measure how long a vulnerability has remained unaddressed. Defaults to the time the record was created.'),
+            preserve_default=False,
+        ),
+    ]

From d46f510a114883fb34defc9771bdd58d4bd09bf1 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Wed, 22 Jul 2026 17:47:25 +0400
Subject: [PATCH 07/19] simplify descriptions

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/policy/rules.py b/policy/rules.py
index 7ccd3d7e..961b406c 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -141,9 +141,7 @@ class UnresolvedVulnerabilityCountRule(BaseRule):
     label = "Unresolved Vulnerability Count"
     severity = "warning"
     description = (
-        "Counts individual package-vulnerability links in the product that have not been "
-        "addressed via a VulnerabilityAnalysis with a terminal state "
-        "(resolved, resolved_with_pedigree, or not_affected)."
+        "Detects packages with known vulnerabilities that have not been triaged or addressed."
     )
 
     def count_violations(self, product, threshold, parameters):
@@ -176,10 +174,8 @@ class StaleVulnerabilityRule(BaseRule):
     label = "Stale Vulnerability"
     severity = "error"
     description = (
-        "Detects packages with a high-risk vulnerability that has remained unaddressed "
-        "beyond a configured delay. The delay is measured from the detected_date on the "
-        "package-vulnerability link, i.e. when the vulnerability was first imported for "
-        "that specific package."
+        "Detects packages with high-risk vulnerabilities that have remained unaddressed "
+        "beyond a configured number of days."
     )
     parameters_schema = {
         "max_days": (

From 5b6c9b7fdc853976341181648bd165060faca389 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:16:06 +0400
Subject: [PATCH 08/19] refine rules filtering system

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py              | 80 +++++++++++++++++++-----------------
 policy/tests/test_rules.py   |  2 +-
 product_portfolio/filters.py |  2 +-
 3 files changed, 45 insertions(+), 39 deletions(-)

diff --git a/policy/rules.py b/policy/rules.py
index 961b406c..d223c244 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -35,6 +35,13 @@ def get_package_filter(self):
         """Return queryset filter kwargs for ProductPackage to identify violating packages."""
         return {}
 
+    def filter_queryset(self, queryset, parameters=None):
+        """Filter a ProductPackage queryset to packages that violate this rule."""
+        package_filter = self.get_package_filter()
+        if package_filter:
+            return queryset.filter(**package_filter)
+        return queryset
+
 
 class PackageBaseRule(BaseRule):
     """Base for rules that count packages matching a fixed filter within a product."""
@@ -112,27 +119,24 @@ class VulnerabilityDetectedRule(BaseRule):
     rule_type = "vulnerability_detected"
     label = "Vulnerability Detected"
     severity = "error"
-    description = "Detects packages with at least one known vulnerability (non-null risk score)."
+    description = "Detects packages with at least one known vulnerability."
     parameters_schema = {
         "min_risk_score": "Minimum risk score (0.0-10.0). Default: any vulnerability.",
     }
 
-    def get_package_filter(self):
-        return {"package__risk_score__isnull": False}
-
-    def count_violations(self, product, threshold, parameters):
-        Package = apps.get_model("component_catalog", "package")
-
-        packages = Package.objects.filter(
-            productpackages__product=product,
-            risk_score__isnull=False,
-        )
-
+    def filter_queryset(self, queryset, parameters=None):
+        parameters = parameters or {}
         min_risk_score = parameters.get("min_risk_score")
         if min_risk_score is not None:
-            packages = packages.filter(risk_score__gte=min_risk_score)
+            return queryset.filter(
+                package__affected_by_vulnerabilities__risk_score__gte=min_risk_score
+            )
+        return queryset.filter(package__affected_by_vulnerabilities__isnull=False)
 
-        count = packages.count()
+    def count_violations(self, product, threshold, parameters):
+        ProductPackage = apps.get_model("product_portfolio", "productpackage")
+        product_packages = ProductPackage.objects.filter(product=product)
+        count = self.filter_queryset(product_packages, parameters).distinct().count()
         return count if count > threshold else 0
 
 
@@ -144,28 +148,28 @@ class UnresolvedVulnerabilityCountRule(BaseRule):
         "Detects packages with known vulnerabilities that have not been triaged or addressed."
     )
 
-    def count_violations(self, product, threshold, parameters):
+    def filter_queryset(self, queryset, parameters=None):
         PackageAffectedByVulnerability = apps.get_model(
             "component_catalog", "packageaffectedbyvulnerability"
         )
         VulnerabilityAnalysis = apps.get_model("vulnerabilities", "vulnerabilityanalysis")
 
         terminal_analysis = VulnerabilityAnalysis.objects.filter(
-            product=product,
+            product_package=OuterRef(OuterRef("pk")),
             state__in=TERMINAL_VULNERABILITY_STATES,
-            package=OuterRef("package"),
             vulnerability=OuterRef("vulnerability"),
         )
-
-        count = (
-            PackageAffectedByVulnerability.objects.filter(
-                package__productpackages__product=product,
-            )
-            .annotate(has_terminal_analysis=Exists(terminal_analysis))
-            .filter(has_terminal_analysis=False)
-            .distinct()
-            .count()
+        unresolved_link = (
+            PackageAffectedByVulnerability.objects.filter(package=OuterRef("package"))
+            .annotate(has_terminal=Exists(terminal_analysis))
+            .filter(has_terminal=False)
         )
+        return queryset.filter(Exists(unresolved_link))
+
+    def count_violations(self, product, threshold, parameters):
+        ProductPackage = apps.get_model("product_portfolio", "productpackage")
+        product_packages = ProductPackage.objects.filter(product=product)
+        count = self.filter_queryset(product_packages).distinct().count()
         return count if count > threshold else 0
 
 
@@ -187,35 +191,37 @@ class StaleVulnerabilityRule(BaseRule):
         ),
     }
 
-    def count_violations(self, product, threshold, parameters):
+    def filter_queryset(self, queryset, parameters=None):
         PackageAffectedByVulnerability = apps.get_model(
             "component_catalog", "packageaffectedbyvulnerability"
         )
         VulnerabilityAnalysis = apps.get_model("vulnerabilities", "vulnerabilityanalysis")
 
+        parameters = parameters or {}
         max_days = parameters.get("max_days", 30)
         min_risk_score = parameters.get("min_risk_score", 8.0)
         cutoff_date = timezone.now() - timedelta(days=max_days)
 
         terminal_analysis = VulnerabilityAnalysis.objects.filter(
-            product=product,
+            product_package=OuterRef(OuterRef("pk")),
             state__in=TERMINAL_VULNERABILITY_STATES,
-            package=OuterRef("package"),
             vulnerability=OuterRef("vulnerability"),
         )
-
-        count = (
+        stale_link = (
             PackageAffectedByVulnerability.objects.filter(
-                package__productpackages__product=product,
+                package=OuterRef("package"),
                 vulnerability__risk_score__gte=min_risk_score,
                 detected_date__lte=cutoff_date,
             )
-            .annotate(has_terminal_analysis=Exists(terminal_analysis))
-            .filter(has_terminal_analysis=False)
-            .values("package_id")
-            .distinct()
-            .count()
+            .annotate(has_terminal=Exists(terminal_analysis))
+            .filter(has_terminal=False)
         )
+        return queryset.filter(Exists(stale_link))
+
+    def count_violations(self, product, threshold, parameters):
+        ProductPackage = apps.get_model("product_portfolio", "productpackage")
+        product_packages = ProductPackage.objects.filter(product=product)
+        count = self.filter_queryset(product_packages, parameters).distinct().count()
         return count if count > threshold else 0
 
 
diff --git a/policy/tests/test_rules.py b/policy/tests/test_rules.py
index 596f70b4..3843cdc0 100644
--- a/policy/tests/test_rules.py
+++ b/policy/tests/test_rules.py
@@ -157,7 +157,7 @@ def setUp(self):
 
     def test_counts_packages_with_any_vulnerability(self):
         package = make_package(self.dataspace)
-        make_vulnerability(self.dataspace, affecting=package, risk_score=5.0)
+        make_vulnerability(self.dataspace, affecting=package)
         make_product_package(self.product, package=package)
         make_product_package(self.product, package=make_package(self.dataspace))
         count = VulnerabilityDetectedRule().count_violations(self.product, 0, {})
diff --git a/product_portfolio/filters.py b/product_portfolio/filters.py
index f6521aae..858a5113 100644
--- a/product_portfolio/filters.py
+++ b/product_portfolio/filters.py
@@ -429,7 +429,7 @@ def filter_by_policy_rule(self, queryset, name, value):
         handler = RULE_REGISTRY.get(value)
         if not handler:
             return queryset
-        return queryset.filter(**handler.get_package_filter())
+        return handler.filter_queryset(queryset).distinct()
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)

From 95fb3dc183c46a4def4f822277f1057f33b28271 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:19:44 +0400
Subject: [PATCH 09/19] refine wording

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 .../compliance/compliance_panels.html                  | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
index 550bc451..e5444438 100644
--- a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
+++ b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
@@ -11,8 +11,8 @@ <h3 class="fs-6 fw-medium mb-0">{% trans "Policy violations" %}</h3>
             <button type="button"
                     class="btn btn-link p-0 text-body-tertiary lh-1"
                     data-bs-toggle="modal"
-                    data-bs-target="#active-rules-modal"
-                    aria-label="{% trans 'View active rules' %}">
+                    data-bs-target="#policy-rules-modal"
+                    aria-label="{% trans 'View policy rules' %}">
               <i class="fas fa-circle-info small"></i>
             </button>
           </div>
@@ -32,16 +32,16 @@ <h3 class="fs-6 fw-medium mb-0">{% trans "Policy violations" %}</h3>
               </form>
             {% endif %}
             <span class="badge bg-danger-subtle text-danger-emphasis">
-              {{ policy_violation_count }} {% trans "active" %}
+              {{ policy_violation_count }} {% trans "triggered" %}
             </span>
           </div>
         </div>
 
-        <div class="modal fade" id="active-rules-modal" tabindex="-1" aria-labelledby="active-rules-modal-label" aria-hidden="true">
+        <div class="modal fade" id="policy-rules-modal" tabindex="-1" aria-labelledby="policy-rules-modal-label" aria-hidden="true">
           <div class="modal-dialog">
             <div class="modal-content">
               <div class="modal-header">
-                <h5 class="modal-title fs-6 fw-medium" id="active-rules-modal-label">{% trans "Active rules" %}</h5>
+                <h5 class="modal-title fs-6 fw-medium" id="policy-rules-modal-label">{% trans "Policy rules" %}</h5>
                 <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="{% trans 'Close' %}"></button>
               </div>
               <div class="modal-body p-0">

From c3338824f4b01152876acd4f51978ff11aa529a3 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:22:33 +0400
Subject: [PATCH 10/19] rename class

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py            | 8 ++++----
 policy/tests/test_rules.py | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/policy/rules.py b/policy/rules.py
index d223c244..f971c2d8 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -140,9 +140,9 @@ def count_violations(self, product, threshold, parameters):
         return count if count > threshold else 0
 
 
-class UnresolvedVulnerabilityCountRule(BaseRule):
-    rule_type = "unresolved_vulnerability_count"
-    label = "Unresolved Vulnerability Count"
+class UnresolvedVulnerabilityRule(BaseRule):
+    rule_type = "unresolved_vulnerability"
+    label = "Unresolved Vulnerability"
     severity = "warning"
     description = (
         "Detects packages with known vulnerabilities that have not been triaged or addressed."
@@ -232,6 +232,6 @@ def count_violations(self, product, threshold, parameters):
     LicensePolicyWarningRule.rule_type: LicensePolicyWarningRule(),
     LicenseCoverageGapRule.rule_type: LicenseCoverageGapRule(),
     VulnerabilityDetectedRule.rule_type: VulnerabilityDetectedRule(),
-    UnresolvedVulnerabilityCountRule.rule_type: UnresolvedVulnerabilityCountRule(),
+    UnresolvedVulnerabilityRule.rule_type: UnresolvedVulnerabilityRule(),
     StaleVulnerabilityRule.rule_type: StaleVulnerabilityRule(),
 }
diff --git a/policy/tests/test_rules.py b/policy/tests/test_rules.py
index 3843cdc0..2ed6596d 100644
--- a/policy/tests/test_rules.py
+++ b/policy/tests/test_rules.py
@@ -23,7 +23,7 @@
 from policy.rules import LicensePolicyErrorRule
 from policy.rules import LicensePolicyWarningRule
 from policy.rules import StaleVulnerabilityRule
-from policy.rules import UnresolvedVulnerabilityCountRule
+from policy.rules import UnresolvedVulnerabilityRule
 from policy.rules import UsagePolicyErrorRule
 from policy.rules import UsagePolicyWarningRule
 from policy.rules import VulnerabilityDetectedRule
@@ -182,7 +182,7 @@ def test_min_risk_score_includes_packages_at_or_above_threshold(self):
         self.assertEqual(1, count)
 
 
-class UnresolvedVulnerabilityCountRuleTestCase(TestCase):
+class UnresolvedVulnerabilityRuleTestCase(TestCase):
     def setUp(self):
         self.dataspace = Dataspace.objects.create(name="nexB")
         self.product = make_product(self.dataspace)
@@ -191,7 +191,7 @@ def test_counts_unanalyzed_package_vulnerability_links(self):
         package = make_package(self.dataspace)
         make_vulnerability(self.dataspace, affecting=package)
         make_product_package(self.product, package=package)
-        count = UnresolvedVulnerabilityCountRule().count_violations(self.product, 0, {})
+        count = UnresolvedVulnerabilityRule().count_violations(self.product, 0, {})
         self.assertEqual(1, count)
 
     def test_does_not_count_links_with_terminal_analysis(self):
@@ -199,7 +199,7 @@ def test_does_not_count_links_with_terminal_analysis(self):
         vulnerability = make_vulnerability(self.dataspace, affecting=package)
         product_package = make_product_package(self.product, package=package)
         make_vulnerability_analysis(product_package, vulnerability, state="resolved")
-        count = UnresolvedVulnerabilityCountRule().count_violations(self.product, 0, {})
+        count = UnresolvedVulnerabilityRule().count_violations(self.product, 0, {})
         self.assertEqual(0, count)
 
 

From b730fe42064e65f24f929271b22481cb7d1ab73f Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:32:08 +0400
Subject: [PATCH 11/19] adjust rules

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py                                        | 10 ++++------
 .../compliance/compliance_panels.html                  |  2 +-
 2 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/policy/rules.py b/policy/rules.py
index f971c2d8..9e8fc678 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -70,9 +70,7 @@ class UsagePolicyErrorRule(PackageBaseRule):
     rule_type = "usage_policy_error"
     label = "Usage Policy Error"
     severity = "error"
-    description = (
-        "Detects packages assigned a usage policy with a compliance alert level of 'error'."
-    )
+    description = "Detects packages assigned a usage policy with a compliance alert level of error."
     package_filter = {"usage_policy__compliance_alert": "error"}
 
 
@@ -80,7 +78,7 @@ class UsagePolicyWarningRule(PackageBaseRule):
     rule_type = "usage_policy_warning"
     label = "Usage Policy Warning"
     description = (
-        "Detects packages assigned a usage policy with a compliance alert level of 'warning'."
+        "Detects packages assigned a usage policy with a compliance alert level of warning."
     )
     package_filter = {"usage_policy__compliance_alert": "warning"}
 
@@ -91,7 +89,7 @@ class LicensePolicyErrorRule(PackageBaseRule):
     severity = "error"
     description = (
         "Detects packages whose licenses are assigned a usage policy"
-        " with a compliance alert level of 'error'."
+        " with a compliance alert level of error."
     )
     package_filter = {"licenses__usage_policy__compliance_alert": "error"}
 
@@ -101,7 +99,7 @@ class LicensePolicyWarningRule(PackageBaseRule):
     label = "License Policy Warning"
     description = (
         "Detects packages whose licenses are assigned a usage policy"
-        " with a compliance alert level of 'warning'."
+        " with a compliance alert level of warning."
     )
     package_filter = {"licenses__usage_policy__compliance_alert": "warning"}
 
diff --git a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
index e5444438..6ce70782 100644
--- a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
+++ b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
@@ -95,7 +95,7 @@ <h5 class="modal-title fs-6 fw-medium" id="policy-rules-modal-label">{% trans "P
               </td>
               <td class="text-body-secondary small">{{ violation.rule_description }}</td>
               <td class="text-end">
-                <a href="{{ product_url }}?inventory-policy_rule={{ violation.rule_type }}#inventory"
+                <a href="{{ product_url }}?inventory-object_type=package&amp;inventory-policy_rule={{ violation.rule_type }}#inventory"
                    class="text-decoration-none">
                   {{ violation.violation_count }}
                 </a>

From c9bfbf2a78d82c914e7b70fc2a0b873a4c210833 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:36:42 +0400
Subject: [PATCH 12/19] adjust active filter rendering

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 product_portfolio/filters.py                  | 21 ++++++++++++-------
 .../compliance/compliance_panels.html         |  2 +-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/product_portfolio/filters.py b/product_portfolio/filters.py
index 858a5113..bc71092a 100644
--- a/product_portfolio/filters.py
+++ b/product_portfolio/filters.py
@@ -264,6 +264,19 @@ class BaseProductRelationFilterSet(DataspacedFilterSet):
         field_name="licenses__usage_policy__compliance_alert",
         distinct=True,
     )
+    policy_rule = django_filters.CharFilter(
+        label=_("Policy rule"),
+        method="filter_by_policy_rule",
+    )
+
+    def filter_by_policy_rule(self, queryset, name, value):
+        """Filter packages that triggered the given policy rule type."""
+        if queryset.model is not ProductPackage:
+            return queryset.none()
+        handler = RULE_REGISTRY.get(value)
+        if not handler:
+            return queryset
+        return handler.filter_queryset(queryset).distinct()
 
     @staticmethod
     def filter_object_type(queryset, name, value):
@@ -408,7 +421,6 @@ class ProductPackageFilterSet(BaseProductRelationFilterSet):
         field_name="package__usage_policy__compliance_alert",
         distinct=True,
     )
-    policy_rule = django_filters.CharFilter(method="filter_by_policy_rule")
 
     class Meta:
         model = ProductPackage
@@ -424,13 +436,6 @@ class Meta:
             "exploitability",
         ]
 
-    def filter_by_policy_rule(self, queryset, name, value):
-        """Filter packages that triggered the given policy rule type."""
-        handler = RULE_REGISTRY.get(value)
-        if not handler:
-            return queryset
-        return handler.filter_queryset(queryset).distinct()
-
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
         self.filters["vulnerability_analyses__state"].extra["null_label"] = "(No values)"
diff --git a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
index 6ce70782..e5444438 100644
--- a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
+++ b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
@@ -95,7 +95,7 @@ <h5 class="modal-title fs-6 fw-medium" id="policy-rules-modal-label">{% trans "P
               </td>
               <td class="text-body-secondary small">{{ violation.rule_description }}</td>
               <td class="text-end">
-                <a href="{{ product_url }}?inventory-object_type=package&amp;inventory-policy_rule={{ violation.rule_type }}#inventory"
+                <a href="{{ product_url }}?inventory-policy_rule={{ violation.rule_type }}#inventory"
                    class="text-decoration-none">
                   {{ violation.violation_count }}
                 </a>

From 5376e940ac3431d48d0c897556da232eb99ac172 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:43:40 +0400
Subject: [PATCH 13/19] simplify descriptions

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/policy/rules.py b/policy/rules.py
index 9e8fc678..eb8253f9 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -70,7 +70,7 @@ class UsagePolicyErrorRule(PackageBaseRule):
     rule_type = "usage_policy_error"
     label = "Usage Policy Error"
     severity = "error"
-    description = "Detects packages assigned a usage policy with a compliance alert level of error."
+    description = "Detects packages assigned a usage policy flagged with an error compliance alert."
     package_filter = {"usage_policy__compliance_alert": "error"}
 
 
@@ -78,7 +78,7 @@ class UsagePolicyWarningRule(PackageBaseRule):
     rule_type = "usage_policy_warning"
     label = "Usage Policy Warning"
     description = (
-        "Detects packages assigned a usage policy with a compliance alert level of warning."
+        "Detects packages assigned a usage policy flagged with a warning compliance alert."
     )
     package_filter = {"usage_policy__compliance_alert": "warning"}
 
@@ -89,7 +89,7 @@ class LicensePolicyErrorRule(PackageBaseRule):
     severity = "error"
     description = (
         "Detects packages whose licenses are assigned a usage policy"
-        " with a compliance alert level of error."
+        " flagged with an error compliance alert."
     )
     package_filter = {"licenses__usage_policy__compliance_alert": "error"}
 
@@ -99,7 +99,7 @@ class LicensePolicyWarningRule(PackageBaseRule):
     label = "License Policy Warning"
     description = (
         "Detects packages whose licenses are assigned a usage policy"
-        " with a compliance alert level of warning."
+        " flagged with a warning compliance alert."
     )
     package_filter = {"licenses__usage_policy__compliance_alert": "warning"}
 
@@ -107,9 +107,7 @@ class LicensePolicyWarningRule(PackageBaseRule):
 class LicenseCoverageGapRule(PackageBaseRule):
     rule_type = "license_coverage_gap"
     label = "License Coverage Gap"
-    description = (
-        "Detects packages with no license expression, indicating a gap in license coverage."
-    )
+    description = "Detects packages with no license expression."
     package_filter = {"license_expression": ""}
 
 
@@ -143,7 +141,7 @@ class UnresolvedVulnerabilityRule(BaseRule):
     label = "Unresolved Vulnerability"
     severity = "warning"
     description = (
-        "Detects packages with known vulnerabilities that have not been triaged or addressed."
+        "Detects packages with known vulnerabilities and no completed vulnerability analysis."
     )
 
     def filter_queryset(self, queryset, parameters=None):
@@ -176,8 +174,8 @@ class StaleVulnerabilityRule(BaseRule):
     label = "Stale Vulnerability"
     severity = "error"
     description = (
-        "Detects packages with high-risk vulnerabilities that have remained unaddressed "
-        "beyond a configured number of days."
+        "Detects packages with high-risk vulnerabilities unaddressed"
+        " for more than the configured number of days."
     )
     parameters_schema = {
         "max_days": (

From bac940935fb388a93eca0dee24feca8d7a43f453 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:48:41 +0400
Subject: [PATCH 14/19] refine ordering for rules

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 product_portfolio/views.py | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/product_portfolio/views.py b/product_portfolio/views.py
index a06cc416..411b462c 100644
--- a/product_portfolio/views.py
+++ b/product_portfolio/views.py
@@ -2868,10 +2868,14 @@ def get_license_compliance_context(licenses, distribution_limit=10):
 
     @staticmethod
     def get_policy_compliance_context(product):
-        policy_violations = list(
-            product.policy_violations.filter(rule_type__in=RULE_REGISTRY.keys())
-            .unresolved()
-            .order_by("rule_type")
+        registry_order = list(RULE_REGISTRY)
+
+        def rule_registry_position(violation):
+            return registry_order.index(violation.rule_type)
+
+        policy_violations = sorted(
+            product.policy_violations.filter(rule_type__in=RULE_REGISTRY.keys()).unresolved(),
+            key=rule_registry_position,
         )
         violated_rule_types = {violation.rule_type for violation in policy_violations}
 

From 754ea92a845d2517ce8978e1ea520d2823c1bb7c Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:50:50 +0400
Subject: [PATCH 15/19] fix queryset

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 product_portfolio/models.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/product_portfolio/models.py b/product_portfolio/models.py
index 70ddb03d..b540f38b 100644
--- a/product_portfolio/models.py
+++ b/product_portfolio/models.py
@@ -252,6 +252,7 @@ def with_policy_violation_count(self):
         subquery = (
             ProductPolicyViolation.objects.filter(
                 product=OuterRef("pk"),
+                rule_type__in=RULE_REGISTRY.keys(),
             )
             .unresolved()
             .values("product")

From 0acd329e99bc59c1c5b227cf1d44ed46a0881413 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 14:57:34 +0400
Subject: [PATCH 16/19] update rule_type and label

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 policy/rules.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/policy/rules.py b/policy/rules.py
index eb8253f9..e75498fa 100644
--- a/policy/rules.py
+++ b/policy/rules.py
@@ -137,8 +137,8 @@ def count_violations(self, product, threshold, parameters):
 
 
 class UnresolvedVulnerabilityRule(BaseRule):
-    rule_type = "unresolved_vulnerability"
-    label = "Unresolved Vulnerability"
+    rule_type = "vulnerability_unresolved"
+    label = "Vulnerability Unresolved"
     severity = "warning"
     description = (
         "Detects packages with known vulnerabilities and no completed vulnerability analysis."
@@ -170,8 +170,8 @@ def count_violations(self, product, threshold, parameters):
 
 
 class StaleVulnerabilityRule(BaseRule):
-    rule_type = "stale_vulnerability"
-    label = "Stale Vulnerability"
+    rule_type = "vulnerability_stale"
+    label = "Vulnerability Stale"
     severity = "error"
     description = (
         "Detects packages with high-risk vulnerabilities unaddressed"

From 5c2331e88900ac68a702c7df71169bd6eba7436e Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 18:38:33 +0400
Subject: [PATCH 17/19] rework label color

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 .../compliance/compliance_panels.html                | 12 +++++++++---
 .../product_portfolio/compliance/metric_cards.html   |  2 +-
 product_portfolio/views.py                           |  4 ++++
 3 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
index e5444438..1f657cd7 100644
--- a/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
+++ b/product_portfolio/templates/product_portfolio/compliance/compliance_panels.html
@@ -31,9 +31,15 @@ <h3 class="fs-6 fw-medium mb-0">{% trans "Policy violations" %}</h3>
                 </button>
               </form>
             {% endif %}
-            <span class="badge bg-danger-subtle text-danger-emphasis">
-              {{ policy_violation_count }} {% trans "triggered" %}
-            </span>
+            {% if has_error_violation %}
+              <span class="badge bg-danger-subtle text-danger-emphasis">
+                {{ policy_violation_count }} {% trans "triggered" %}
+              </span>
+            {% else %}
+              <span class="badge bg-warning-subtle text-warning-emphasis">
+                {{ policy_violation_count }} {% trans "triggered" %}
+              </span>
+            {% endif %}
           </div>
         </div>
 
diff --git a/product_portfolio/templates/product_portfolio/compliance/metric_cards.html b/product_portfolio/templates/product_portfolio/compliance/metric_cards.html
index 14bd04e8..f95f2062 100644
--- a/product_portfolio/templates/product_portfolio/compliance/metric_cards.html
+++ b/product_portfolio/templates/product_portfolio/compliance/metric_cards.html
@@ -7,7 +7,7 @@
         <div class="fs-4 fw-medium lh-sm text-success">0</div>
         <div class="text-body-tertiary fs-xs mt-1">{% trans "No active violations" %}</div>
       {% else %}
-        <div class="fs-4 fw-medium lh-sm text-danger">{{ policy_violation_count }}</div>
+        <div class="fs-4 fw-medium lh-sm {% if has_error_violation %}text-danger{% else %}text-warning{% endif %}">{{ policy_violation_count }}</div>
         <div class="text-body-tertiary fs-xs mt-1">
           <a href="#policy-violations" class="text-decoration-none">
             {{ policy_violation_count }} {% trans "rule" %}{{ policy_violation_count|pluralize }} {% trans "triggered" %}
diff --git a/product_portfolio/views.py b/product_portfolio/views.py
index 411b462c..7fdecf5b 100644
--- a/product_portfolio/views.py
+++ b/product_portfolio/views.py
@@ -2895,9 +2895,13 @@ def rule_registry_position(violation):
             }
             for rule_type, handler in RULE_REGISTRY.items()
         ]
+        has_error_violation = any(
+            violation.rule_severity == "error" for violation in policy_violations
+        )
         return {
             "policy_violations": policy_violations,
             "policy_violation_count": len(policy_violations),
+            "has_error_violation": has_error_violation,
             "all_rules": all_rules,
         }
 

From 0dada49a7552a99ac19cdab8473e86fce3ab32d1 Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 18:52:49 +0400
Subject: [PATCH 18/19] provide config paramter to the filter

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 product_portfolio/filters.py | 4 +++-
 product_portfolio/views.py   | 5 +----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/product_portfolio/filters.py b/product_portfolio/filters.py
index bc71092a..06134052 100644
--- a/product_portfolio/filters.py
+++ b/product_portfolio/filters.py
@@ -276,7 +276,9 @@ def filter_by_policy_rule(self, queryset, name, value):
         handler = RULE_REGISTRY.get(value)
         if not handler:
             return queryset
-        return handler.filter_queryset(queryset).distinct()
+        rules_config = self.dataspace.get_configuration("policy_rules_config") or {}
+        parameters = rules_config.get(value, {}).get("parameters", {})
+        return handler.filter_queryset(queryset, parameters).distinct()
 
     @staticmethod
     def filter_object_type(queryset, name, value):
diff --git a/product_portfolio/views.py b/product_portfolio/views.py
index 7fdecf5b..380f160c 100644
--- a/product_portfolio/views.py
+++ b/product_portfolio/views.py
@@ -2879,10 +2879,7 @@ def rule_registry_position(violation):
         )
         violated_rule_types = {violation.rule_type for violation in policy_violations}
 
-        try:
-            rules_config = product.dataspace.configuration.policy_rules_config or {}
-        except AttributeError:
-            rules_config = {}
+        rules_config = product.dataspace.get_configuration("policy_rules_config") or {}
 
         all_rules = [
             {

From c4dc56da5cee8713d89fc1e32e6984a46a4f71ff Mon Sep 17 00:00:00 2001
From: tdruez <tdruez@aboutcode.org>
Date: Thu, 23 Jul 2026 19:06:42 +0400
Subject: [PATCH 19/19] add unit tests

Signed-off-by: tdruez <tdruez@aboutcode.org>
---
 component_catalog/tests/test_models.py  |  9 ++++++-
 policy/tests/test_rules.py              | 27 +++++++++++++++++++
 product_portfolio/tests/test_filters.py | 36 +++++++++++++++++++++++++
 product_portfolio/tests/test_models.py  |  5 ++++
 4 files changed, 76 insertions(+), 1 deletion(-)

diff --git a/component_catalog/tests/test_models.py b/component_catalog/tests/test_models.py
index ecb9fdc5..195062b5 100644
--- a/component_catalog/tests/test_models.py
+++ b/component_catalog/tests/test_models.py
@@ -36,6 +36,7 @@
 from component_catalog.models import ComponentType
 from component_catalog.models import LicenseExpressionMixin
 from component_catalog.models import Package
+from component_catalog.models import PackageAffectedByVulnerability
 from component_catalog.models import PackageAlreadyExistsWarning
 from component_catalog.models import Subcomponent
 from component_catalog.tests import make_package
@@ -1372,9 +1373,15 @@ def test_component_catalog_models_get_exclude_candidates_fields(self):
         )
 
         for model_class, expected in input_data:
-            results = [f.name for f in model_class().get_exclude_candidates_fields()]
+            results = [field.name for field in model_class().get_exclude_candidates_fields()]
             self.assertEqual(sorted(expected), sorted(results))
 
+    def test_package_affected_by_vulnerability_excludes_auto_now_add_fields(self):
+        field_names = [
+            field.name for field in PackageAffectedByVulnerability().get_exclude_candidates_fields()
+        ]
+        self.assertNotIn("detected_date", field_names)
+
     def test_component_create_with_or_and_and_in_license_name_and_key(self):
         or_license = License.objects.create(
             key="orrible",
diff --git a/policy/tests/test_rules.py b/policy/tests/test_rules.py
index 2ed6596d..4c52ebfa 100644
--- a/policy/tests/test_rules.py
+++ b/policy/tests/test_rules.py
@@ -202,6 +202,22 @@ def test_does_not_count_links_with_terminal_analysis(self):
         count = UnresolvedVulnerabilityRule().count_violations(self.product, 0, {})
         self.assertEqual(0, count)
 
+    def test_does_not_count_links_with_resolved_with_pedigree_analysis(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package)
+        product_package = make_product_package(self.product, package=package)
+        make_vulnerability_analysis(product_package, vulnerability, state="resolved_with_pedigree")
+        count = UnresolvedVulnerabilityRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
+    def test_does_not_count_links_with_not_affected_analysis(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package)
+        product_package = make_product_package(self.product, package=package)
+        make_vulnerability_analysis(product_package, vulnerability, state="not_affected")
+        count = UnresolvedVulnerabilityRule().count_violations(self.product, 0, {})
+        self.assertEqual(0, count)
+
 
 class StaleVulnerabilityRuleTestCase(TestCase):
     def setUp(self):
@@ -237,6 +253,17 @@ def test_does_not_count_links_below_min_risk_score(self):
         count = StaleVulnerabilityRule().count_violations(self.product, 0, {})
         self.assertEqual(0, count)
 
+    def test_custom_max_days_triggers_for_links_within_window(self):
+        package = make_package(self.dataspace)
+        vulnerability = make_vulnerability(self.dataspace, affecting=package, risk_score=9.0)
+        make_product_package(self.product, package=package)
+        recent_date = timezone.now() - timedelta(days=10)
+        PackageAffectedByVulnerability.objects.filter(
+            package=package, vulnerability=vulnerability
+        ).update(detected_date=recent_date)
+        count = StaleVulnerabilityRule().count_violations(self.product, 0, {"max_days": 5})
+        self.assertEqual(1, count)
+
     def test_does_not_count_stale_links_with_terminal_analysis(self):
         package = make_package(self.dataspace)
         vulnerability = make_vulnerability(self.dataspace, affecting=package, risk_score=9.0)
diff --git a/product_portfolio/tests/test_filters.py b/product_portfolio/tests/test_filters.py
index 024a68e2..1dfa6173 100644
--- a/product_portfolio/tests/test_filters.py
+++ b/product_portfolio/tests/test_filters.py
@@ -10,18 +10,22 @@
 from django.test import TestCase
 
 from component_catalog.models import Package
+from component_catalog.tests import make_component
 from component_catalog.tests import make_package
 from dje.models import Dataspace
 from license_library.models import License
 from organization.models import Owner
 from policy.models import UsagePolicy
+from product_portfolio.filters import ProductComponentFilterSet
 from product_portfolio.filters import ProductFilterSet
 from product_portfolio.filters import ProductPackageFilterSet
 from product_portfolio.models import Product
 from product_portfolio.models import ProductPackage
 from product_portfolio.models import ProductPolicyViolation
 from product_portfolio.tests import make_product
+from product_portfolio.tests import make_product_component
 from product_portfolio.tests import make_product_package
+from vulnerabilities.tests import make_vulnerability
 
 
 class ProductPackageFilterSetTestCase(TestCase):
@@ -164,3 +168,35 @@ def test_filter_by_unknown_rule_returns_all(self):
         )
         self.assertIn(self.pp_with_policy, filterset.qs)
         self.assertIn(self.pp_without_policy, filterset.qs)
+
+
+class ProductPackageFilterByRuleDistinctTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+
+    def test_filter_by_vulnerability_rule_returns_distinct_results(self):
+        package = make_package(self.dataspace)
+        make_vulnerability(self.dataspace, affecting=package)
+        make_vulnerability(self.dataspace, affecting=package)
+        make_product_package(self.product, package=package)
+        filterset = ProductPackageFilterSet(
+            dataspace=self.dataspace,
+            data={"policy_rule": "vulnerability_detected"},
+        )
+        self.assertEqual(1, filterset.qs.count())
+
+
+class ProductComponentFilterByRuleTestCase(TestCase):
+    def setUp(self):
+        self.dataspace = Dataspace.objects.create(name="nexB")
+        self.product = make_product(self.dataspace)
+
+    def test_filter_by_policy_rule_returns_empty_for_components(self):
+        component = make_component(self.dataspace)
+        make_product_component(self.product, component=component)
+        filterset = ProductComponentFilterSet(
+            dataspace=self.dataspace,
+            data={"policy_rule": "usage_policy_error"},
+        )
+        self.assertEqual(0, filterset.qs.count())
diff --git a/product_portfolio/tests/test_models.py b/product_portfolio/tests/test_models.py
index 9158613f..e7773d16 100644
--- a/product_portfolio/tests/test_models.py
+++ b/product_portfolio/tests/test_models.py
@@ -1375,6 +1375,11 @@ def test_with_policy_violation_count_counts_unresolved_violations(self):
         qs = Product.unsecured_objects.filter(pk=self.product.pk).with_policy_violation_count()
         self.assertEqual(2, qs.get().policy_violation_count)
 
+    def test_with_policy_violation_count_excludes_obsolete_rule_types(self):
+        self._make_violation("obsolete_rule")
+        qs = Product.unsecured_objects.filter(pk=self.product.pk).with_policy_violation_count()
+        self.assertEqual(0, qs.get().policy_violation_count)
+
     def test_with_compliance_issues_includes_product_with_policy_violation(self):
         self._make_violation("usage_policy_error")
         qs = (