--- title: "CreateContainerBaseImageUpdateImpactQuery" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/queries/container-base-image-update-impacts" tags: ["ContainerBaseImageUpdateImpactQueryService"] --- # CreateContainerBaseImageUpdateImpactQuery `POST /v1/namespaces/{tenant_meta.namespace}/queries/container-base-image-update-impacts` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/queries/container-base-image-update-impacts` - Auth: none declared Computes (does not persist) the vulnerability finding impact of each available base image update option for a scanned container image. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - ContainerBaseImageUpdateImpactQueryServiceCreateContainerBaseImageUpdateImpactQueryBody: ContainerBaseImageUpdateImpactQuery computes, on demand, how the vulnerability findings of a scanned container image's base image would change if the base were moved to each of its available update options (refreshed, next, latest). It is a computed query in the style of DashboardSummaryQuery: the response is derived live from existing Finding and PackageVersion records and is never persisted, so it cannot go stale as findings are recomputed. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1ContainerBaseImageUpdateImpactQuerySpec: Spec carries the request and the computed response. - `request` V1ContainerBaseImageUpdateImpactQuerySpecRequest: Inputs that select the app image and shape the computation. - `include_common_records` boolean: Include the inline `common` finding list (present on both the current base and the candidate) in every severity and reachability bucket of every update option. Unset/false returns only `common_num_results` (the count), keeping the default response size unchanged. The common set is normally the largest bucket by a wide margin; for a full list use ContainerBaseImageUpdateImpactRecordsQueryService with RECORD_KIND_COMMON regardless of this flag. - `max_top_records_per_bucket` integer: Maximum number of top changed findings per list, in both the severity_records and reachability_records groupings. Applied to each bucket's fixed and introduced lists separately (e.g. up to this many fixed and this many introduced criticals). Unset defaults to 10; set to 0 to omit the inline lists (counts only, cheaper). Capped at 100; for a full per-bucket list use ContainerBaseImageUpdateImpactRecordsQueryService. A single-digit value is typical (cf. the dashboard's top-N of 8). - `package_version_uuid` string, required: The scanned application image PackageVersion whose container_metadata.base_image.update_options define the candidates to assess. Its own findings supply the reachability that is projected onto the base image findings, since candidate base scans do not measure reachability themselves. - `record_scope` 'FINDING_RECORD_SCOPE_UNSPECIFIED' | 'FINDING_RECORD_SCOPE_ALL' | 'FINDING_RECORD_SCOPE_VULNERABILITY': Which finding types populate the record-level fixed/introduced lists. Shared by the impact query, the records drill-down query, and the container context diff queries. The severity/reachability COUNT fields are always computed both ways (all_counts and vuln_counts); this selects only which findings appear in the record lists and, correspondingly, which totals those record views reconcile against. - FINDING_RECORD_SCOPE_UNSPECIFIED: Unset; treated as FINDING_RECORD_SCOPE_ALL. - FINDING_RECORD_SCOPE_ALL: All finding types. Record views reconcile with all_counts / all_changes. - FINDING_RECORD_SCOPE_VULNERABILITY: Vulnerability findings only. Record views reconcile with vuln_counts / vuln_changes. - `response` V1ContainerBaseImageUpdateImpactQuerySpecResponse: Computed results: shared current-base counts plus one entry per update option available on the app image. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `base_image_digest` string: The current base image manifest digest, copied from the app image's container_metadata.base_image.digest. - `base_image_name` string: The current base image reference (tag), copied from the app image's container_metadata.base_image.name. - `latest_option` ResponseUpdateOption: Impact of one base image update option. - `all_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `digest` string: The candidate base image manifest digest. - `name` string: The candidate base image tag this option points to. - `package_version_uuid` string: The candidate base image PackageVersion UUID. - `reachability_records` ResponseUpdateOptionReachabilityRecords: Top changed findings for one update option, grouped by reachability. - `potentially_reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` ResponseUpdateOptionSeverityRecords: Top changed findings for one update option, grouped by severity. - `critical` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `status` 'STATUS_UNSPECIFIED' | 'STATUS_READY' | 'STATUS_PENDING': Availability of the impact for this update option. - STATUS_UNSPECIFIED: The status was not set. - STATUS_READY: The candidate base was resolved and its impact was computed. - STATUS_PENDING: The update option exists but its candidate PackageVersion has not been scanned yet, so its counts and records are not yet available. - `vuln_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `next_option` ResponseUpdateOption: Impact of one base image update option. - `all_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `digest` string: The candidate base image manifest digest. - `name` string: The candidate base image tag this option points to. - `package_version_uuid` string: The candidate base image PackageVersion UUID. - `reachability_records` ResponseUpdateOptionReachabilityRecords: Top changed findings for one update option, grouped by reachability. - `potentially_reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` ResponseUpdateOptionSeverityRecords: Top changed findings for one update option, grouped by severity. - `critical` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `status` 'STATUS_UNSPECIFIED' | 'STATUS_READY' | 'STATUS_PENDING': Availability of the impact for this update option. - STATUS_UNSPECIFIED: The status was not set. - STATUS_READY: The candidate base was resolved and its impact was computed. - STATUS_PENDING: The update option exists but its candidate PackageVersion has not been scanned yet, so its counts and records are not yet available. - `vuln_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachability_available` boolean: True when OS reachability analysis was enabled and succeeded on the app image scan. When true, the *_reachability_counts fields (here and on each update option) are populated; when false they are left unset and only the *_counts severity breakdowns are returned. - `refreshed_option` ResponseUpdateOption: Impact of one base image update option. - `all_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `digest` string: The candidate base image manifest digest. - `name` string: The candidate base image tag this option points to. - `package_version_uuid` string: The candidate base image PackageVersion UUID. - `reachability_records` ResponseUpdateOptionReachabilityRecords: Top changed findings for one update option, grouped by reachability. - `potentially_reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` ResponseUpdateOptionSeverityRecords: Top changed findings for one update option, grouped by severity. - `critical` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `status` 'STATUS_UNSPECIFIED' | 'STATUS_READY' | 'STATUS_PENDING': Availability of the impact for this update option. - STATUS_UNSPECIFIED: The status was not set. - STATUS_READY: The candidate base was resolved and its impact was computed. - STATUS_PENDING: The update option exists but its candidate PackageVersion has not been scanned yet, so its counts and records are not yet available. - `vuln_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `tenant_meta` object: The query is scoped to a tenant. - `uuid` string: The UUID of the query. ## Response `200` A successful response. - V1ContainerBaseImageUpdateImpactQuery: ContainerBaseImageUpdateImpactQuery computes, on demand, how the vulnerability findings of a scanned container image's base image would change if the base were moved to each of its available update options (refreshed, next, latest). It is a computed query in the style of DashboardSummaryQuery: the response is derived live from existing Finding and PackageVersion records and is never persisted, so it cannot go stale as findings are recomputed. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1ContainerBaseImageUpdateImpactQuerySpec: Spec carries the request and the computed response. - `request` V1ContainerBaseImageUpdateImpactQuerySpecRequest: Inputs that select the app image and shape the computation. - `include_common_records` boolean: Include the inline `common` finding list (present on both the current base and the candidate) in every severity and reachability bucket of every update option. Unset/false returns only `common_num_results` (the count), keeping the default response size unchanged. The common set is normally the largest bucket by a wide margin; for a full list use ContainerBaseImageUpdateImpactRecordsQueryService with RECORD_KIND_COMMON regardless of this flag. - `max_top_records_per_bucket` integer: Maximum number of top changed findings per list, in both the severity_records and reachability_records groupings. Applied to each bucket's fixed and introduced lists separately (e.g. up to this many fixed and this many introduced criticals). Unset defaults to 10; set to 0 to omit the inline lists (counts only, cheaper). Capped at 100; for a full per-bucket list use ContainerBaseImageUpdateImpactRecordsQueryService. A single-digit value is typical (cf. the dashboard's top-N of 8). - `package_version_uuid` string, required: The scanned application image PackageVersion whose container_metadata.base_image.update_options define the candidates to assess. Its own findings supply the reachability that is projected onto the base image findings, since candidate base scans do not measure reachability themselves. - `record_scope` 'FINDING_RECORD_SCOPE_UNSPECIFIED' | 'FINDING_RECORD_SCOPE_ALL' | 'FINDING_RECORD_SCOPE_VULNERABILITY': Which finding types populate the record-level fixed/introduced lists. Shared by the impact query, the records drill-down query, and the container context diff queries. The severity/reachability COUNT fields are always computed both ways (all_counts and vuln_counts); this selects only which findings appear in the record lists and, correspondingly, which totals those record views reconcile against. - FINDING_RECORD_SCOPE_UNSPECIFIED: Unset; treated as FINDING_RECORD_SCOPE_ALL. - FINDING_RECORD_SCOPE_ALL: All finding types. Record views reconcile with all_counts / all_changes. - FINDING_RECORD_SCOPE_VULNERABILITY: Vulnerability findings only. Record views reconcile with vuln_counts / vuln_changes. - `response` V1ContainerBaseImageUpdateImpactQuerySpecResponse: Computed results: shared current-base counts plus one entry per update option available on the app image. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `base_image_digest` string: The current base image manifest digest, copied from the app image's container_metadata.base_image.digest. - `base_image_name` string: The current base image reference (tag), copied from the app image's container_metadata.base_image.name. - `latest_option` ResponseUpdateOption: Impact of one base image update option. - `all_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `digest` string: The candidate base image manifest digest. - `name` string: The candidate base image tag this option points to. - `package_version_uuid` string: The candidate base image PackageVersion UUID. - `reachability_records` ResponseUpdateOptionReachabilityRecords: Top changed findings for one update option, grouped by reachability. - `potentially_reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` ResponseUpdateOptionSeverityRecords: Top changed findings for one update option, grouped by severity. - `critical` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `status` 'STATUS_UNSPECIFIED' | 'STATUS_READY' | 'STATUS_PENDING': Availability of the impact for this update option. - STATUS_UNSPECIFIED: The status was not set. - STATUS_READY: The candidate base was resolved and its impact was computed. - STATUS_PENDING: The update option exists but its candidate PackageVersion has not been scanned yet, so its counts and records are not yet available. - `vuln_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `next_option` ResponseUpdateOption: Impact of one base image update option. - `all_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `digest` string: The candidate base image manifest digest. - `name` string: The candidate base image tag this option points to. - `package_version_uuid` string: The candidate base image PackageVersion UUID. - `reachability_records` ResponseUpdateOptionReachabilityRecords: Top changed findings for one update option, grouped by reachability. - `potentially_reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` ResponseUpdateOptionSeverityRecords: Top changed findings for one update option, grouped by severity. - `critical` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `status` 'STATUS_UNSPECIFIED' | 'STATUS_READY' | 'STATUS_PENDING': Availability of the impact for this update option. - STATUS_UNSPECIFIED: The status was not set. - STATUS_READY: The candidate base was resolved and its impact was computed. - STATUS_PENDING: The update option exists but its candidate PackageVersion has not been scanned yet, so its counts and records are not yet available. - `vuln_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachability_available` boolean: True when OS reachability analysis was enabled and succeeded on the app image scan. When true, the *_reachability_counts fields (here and on each update option) are populated; when false they are left unset and only the *_counts severity breakdowns are returned. - `refreshed_option` ResponseUpdateOption: Impact of one base image update option. - `all_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `digest` string: The candidate base image manifest digest. - `name` string: The candidate base image tag this option points to. - `package_version_uuid` string: The candidate base image PackageVersion UUID. - `reachability_records` ResponseUpdateOptionReachabilityRecords: Top changed findings for one update option, grouped by reachability. - `potentially_reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` ResponseUpdateOptionSeverityRecords: Top changed findings for one update option, grouped by severity. - `critical` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` UpdateOptionFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed and introduced kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Findings present on both the current base and the candidate, unaffected by the update. Taken from the current-base side, since those are the finding UUIDs the caller can act on. Populated only when request.include_common_records is true; capped at max_top_records_per_bucket like fixed and introduced. - … - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped, and is always populated regardless of request.include_common_records). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed by the update (present on the current base, gone on the candidate), capped at max_top_records_per_bucket. Rendered struck through in the UI. - … - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped); drives "View more" and the count shown by the UI. - `introduced` V1BaseImageFindingRecord[]: Top findings introduced by the update (absent on the current base, present on the candidate), capped at max_top_records_per_bucket. - … - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `status` 'STATUS_UNSPECIFIED' | 'STATUS_READY' | 'STATUS_PENDING': Availability of the impact for this update option. - STATUS_UNSPECIFIED: The status was not set. - STATUS_READY: The candidate base was resolved and its impact was computed. - STATUS_PENDING: The update option exists but its candidate PackageVersion has not been scanned yet, so its counts and records are not yet available. - `vuln_changes` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_changes` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the app image scan (see §3). The overall total lives on the sibling SeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseSeverityCounts: Aggregate finding counts broken out by severity. Named distinctly from DashboardSummaryQuery.Spec.Response.FindingCounts to avoid a generated client type-name collision (that message keeps the shorter alias). - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the query. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/queries/container-base-image-update-impacts/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)