Do not list dependencies being checked for CVEs.

[mitchell-as]

DX-3045 CVE report doesn't address updated package

Similar to how we're no longer listing which packages are being installed.

I changed some of the messaging because originally it assumed only one package at a time could be installed (and added, not updated).

Samples:

% state install [email protected]
█ Installing Package

Operating on project qam/newpub, located at /path/to/newpub.

• Searching for packages in the ActiveState Catalog ✔ Found
• Resolving Dependencies ✔ Done
• Checking for vulnerabilities (CVEs) in your project and its dependencies x Unsafe

  Warning: Found 2 new vulnerabilities (CVEs). Severity: 1 High, 1 Medium. Run 'state security' for more info.

Added: language/python/[email protected]

Your local project has been updated.
Run state push to save changes to the platform.

% state install language/[email protected] pytest
█ Installing Package

Operating on project qam/newpub, located at /path/to/newpub.

• Searching for packages in the ActiveState Catalog ✔ Found
• Resolving Dependencies ✔ Done
• Checking for vulnerabilities (CVEs) in your project and its dependencies x Unsafe

  Warning: Found 2 new vulnerabilities (CVEs). Severity: 2 High. Run 'state security' for more info.

Updated: language/[email protected]
Updated: language/python/pytest@Auto

Your local project has been updated.
Run state push to save changes to the platform.

% state install private/ActiveState-CLI-Testing/language/python/django_dep --ts=2024-09-10T16:36:34.393Z
█ Installing Package

Operating on project qam/newpub, located at /path/to/newpub.

• Searching for packages in the ActiveState Catalog ✔ Found
• Resolving Dependencies ✔ Done

  Installing [email protected] includes 1 direct dependencies, and 3 indirect dependencies.
  └─ [email protected] (3 dependencies)

• Checking for vulnerabilities (CVEs) in your project and its dependencies x Unsafe

  Warning: Found 9 new, indirect vulnerabilities (CVEs)

  • 2 Critical: [email protected]: CVE-2023-31047, CVE-2024-42005
  • 7 High: [email protected]: CVE-2023-36053, CVE-2023-41164, CVE-2023-43665, CVE-2024-24680, CVE-2024-41989, 
    CVE-2024-41990, CVE-2024-41991

  For more information on these vulnerabilities run 'state security open <ID>'.
  To disable prompting for vulnerabilities run 'state config set security.prompt.enabled false'.

Do you want to continue installing this dependency despite its vulnerabilities? (y/N)

[Naatan]

I don't feel like it's necessary to make these changes to CVEs or summaries. It was done for install because in terms of solving we only solve what needs solving, which isn't necessarily all user input. Here that is not a factor.

Also, the jira story is a bug, I'd prefer that if we find we need to make functional / UI/UX changes like this we first bounce it back to triage.

[Naatan]

This ought to be addressed at the type level, or in the mediator. Handling it here sprinkles the business logic for handling these types across three packages.

[mitchell-as]

Closing. Will either try again in a new PR, or will put this back in triage.