Skip to main content

​
Overview

GitHubVulnerabilities2Db is a long-running background job (console EXE) that continuously polls the GitHub Advisory Database via GitHub’s v4 GraphQL API and writes any new or updated NuGet-ecosystem vulnerability advisories into the NuGetGallery SQL database. The job is cursor-driven: it stores a DateTimeOffset watermark in Azure Blob Storage so that each run only processes advisories that were published or updated since the last successful run. It loops until the collector reports no more pages of advisories to process, then exits.
This job is the authoritative source for vulnerability data surfaced on nuget.org package pages. It does not perform search re-indexing — that responsibility is deliberately delegated to the V3 pipeline.

​
Role in the NuGetGallery Ecosystem

Data Source

GitHub Advisory Database polled via the v4 GraphQL API.

Data Sink

NuGetGallery SQL database — PackageVulnerabilities and related tables.

Cursor Storage

Azure Blob Storage — a cursor.json blob tracks the last-processed timestamp.

Deployment

Packaged as a NuGet .nuspec and installed as a Windows service via NSSM.

​
Key Files and Classes

​
Dependencies

​
Internal Project References

​
NuGet / Framework Dependencies

​
Notable Patterns and Implementation Details

Cursor-driven incremental processing. Job.Run() calls collector.ProcessAsync() in a while loop until it returns false. Each iteration advances the DurableCursor blob in Azure Storage, so the job is safe to stop and restart at any time without reprocessing old advisories.
Managed Identity authentication for blob storage. The BlobServiceClientFactory is constructed with a ManagedIdentityCredential keyed by UserManagedIdentityClientId from configuration — no connection-string secrets are required in production.
Stub services throw by design. ThrowingAuditingService, ThrowingTelemetryService, and ThrowingSecurityPolicyService all implement Gallery interfaces but throw NotImplementedException on every method. If any of those paths are ever reached, the job will fail loudly rather than silently no-oping.
ThrowingIndexingService.UpdatePackage is intentionally a no-op (not a throw). PackageUpdateService calls UpdatePackage as part of its normal flow. Throwing there would break every vulnerability write. The search index is kept consistent by the V3 pipeline instead.
HttpClient lifetime management. The HttpClient is created as a field on Job and registered with Autofac as ExternallyOwned(). This prevents Autofac from disposing it prematurely — a fix for a specific production issue tracked in NuGetGallery#9194.
Windows service packaging via NSSM. The .nuspec bundles the compiled binaries alongside nssm.exe and PowerShell scripts. The pre/post deploy scripts use NSSM to uninstall the old service instance and install the new one, configured for automatic restart on failure.