This document defines the data structure for "Patch Announcement" documents. These documents are typically sourced from official vendor communications, advisories, changelogs, or release bulletins that announce the availability of patches or updates addressing security vulnerabilities.

🧱 Core Fields

Field	Type	Description
`summary`	string	Short summary of the patch announcement.
`title`	string	Title of the patch bulletin or vendor advisory.
`published_date`	string (ISO 8601)	Date when the patch was officially announced.
`last_updated_date`	string (ISO 8601)	Last updated timestamp from the source.
`scraped_date`	string (ISO 8601)	Date when this patch entry was ingested by our system.
`url`	string	Source URL pointing to the official patch documentation.
`publishing_company`	string	Name of the vendor or company issuing the patch.
`version_info`	string	Release identifier or version tag of the patch.
`classification`	string	Always set to `Patch Announcement` for this type.

🔧 Patch-Specific Fields

Field	Type	Description
`CVEs`	List[string]	CVE identifiers addressed by this patch.
`solution`	string	Official fix details or update instructions.
`vulnerable_products`	List[string]	Flat list of affected products the patch addresses.
`product_vendor`	string	Name of the vendor or maintainer of the affected products.
`references`	List[string]	Related links, changelogs, or patch notes.

📊 Severity Ratings (Optional)

If the vendor or a third-party includes a severity label:

"severities": [
  {
    "origin_name": "Vendor Advisory",
    "severity": "High"
  }
]

📈 CVSS Scores (Optional)

When CVEs in the announcement contain CVSS data:

"cvss": [
  {
    "cve_id": "CVE-2024-12345",
    "cvss_version": "3.1",
    "cvss_risk_assessment": "High",
    "cvss_score": {
      "value": 7.5,
      "label": "High"
    },
    "cvss_vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "parsed_cvss_vector": {
      "Attack Vector": "Network",
      "Attack Complexity": "Low",
      "Privileges Required": "None",
      "User Interaction": "None",
      "Scope": "Unchanged",
      "Confidentiality": "High",
      "Integrity": "High",
      "Availability": "High"
    }
  }
]

✅ Integration Guidance

Match using classification == "Patch Announcement".
Use cvss_score.label or cvss_vector for severity analysis.
solution will always contain guidance, even if minimal.
vulnerable_products supports fast filtering and cross-product matching.
Timestamps use ISO 8601 (e.g., 2025-06-01T00:00:00Z).
references link to supplementary technical or historical context.

Patch Announement

🧱 Core Fields

🔧 Patch-Specific Fields

📊 Severity Ratings (Optional)

📈 CVSS Scores (Optional)

✅ Integration Guidance