Add vulnerabilities to response

Private endpoint /dependencies now returns
array of vulnerabilities for each dependency

ee/app/serializers/dependency_entity.rb

@@ -5,6 +5,11 @@ class DependencyEntity < Grape::Entity
     expose :blob_path, :path
   end
 
+  class VulnerabilityEntity < Grape::Entity
+    expose :name, :severity
+  end
+
   expose :name, :packager, :version
   expose :location, using: LocationEntity
+  expose :vulnerabilities, using: VulnerabilityEntity
 end

ee/changelogs/unreleased/12406-vulnerabilities-to-dl-response.yml

+---
+title: Add vulnerabilities to dependency list
+merge_request: 14761
+author:
+type: added

ee/spec/fixtures/api/schemas/dependency.json

@@ -4,7 +4,8 @@
     "name",
     "packager",
     "version",
-    "location"
+    "location",
+    "vulnerabilities"
   ],
   "properties": {
     "name": {
@@ -23,6 +24,17 @@
       "path": {
         "type": "string"
       }
+    },
+    "vulnerabilities": {
+      "type": "array",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "severity": {
+          "type": "string"
+        }
+      }
     }
   },
   "additionalProperties": false

ee/spec/serializers/dependency_entity_spec.rb

@@ -12,7 +12,16 @@ describe DependencyEntity do
         location: {
           blob_path: '/some_project/path/Gemfile.lock',
           path:      'Gemfile.lock'
-        }
+        },
+        vulnerabilities:
+          [{
+             name:     'DDoS',
+             severity: 'high'
+           },
+           {
+             name:     'XSS vulnerability',
+             severity: 'low'
+           }]
       }
     end
 

ee/spec/serializers/dependency_list_serializer_spec.rb

@@ -15,7 +15,12 @@ describe DependencyListSerializer do
        location: {
          blob_path: '/some_project/path/Gemfile.lock',
          path:      'Gemfile.lock'
-       }
+       },
+       vulnerabilities:
+         [{
+            name:     'XSS',
+            severity: 'low'
+          }]
      }]
   end