Fixed unnecessary error logging when no CPE match is found

[getvictor]

Related issue: Resolves #35447

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes
  • Suppressed unnecessary error logging when no CPE match is found for software items such as VSCode extensions and JetBrains plugins, resulting in cleaner application logs.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[getvictor]

@coderabbitai full review

[coderabbitai]

✅ Actions performed

Full review triggered.

[coderabbitai]

Walkthrough

The PR suppresses unnecessary error logging when no CPE database match is found for software items during vulnerability checking. The CPEFromSoftware function is modified to detect missing entries and return an empty CPE with no error, preventing error-level logs for unmatched software like VSCode extensions and JetBrains plugins.

Changes

Cohort / File(s)	Change Summary
Changelog entry changes/35447-fix-cpe-translation-error-logging	Changelog documenting the fix to suppress error logging for missing CPE translations
CPE translation error handling server/vulnerabilities/nvd/cpe.go	Added guard in CPEFromSoftware to detect sql.ErrNoRows and return empty CPE with nil error instead of propagating error; preserves error propagation for other database errors

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Suggested reviewers

• mostlikelee

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and accurately describes the main change: suppressing error logging when no CPE match is found for software items.
Description check	✅ Passed	The PR description covers required sections: linked issue reference, changes file checklist item completed, and manual QA confirmation. However, automated tests checklist items are not addressed.
Linked Issues check	✅ Passed	The code changes directly address issue #35447 by suppressing error logs for sql.ErrNoRows in CPEFromSoftware, preventing noisy error logging for software items without CPE matches.
Out of Scope Changes check	✅ Passed	All changes are within scope: the changes file documents the user-visible fix, and the code modification only addresses the specific no-rows error case in CPE translation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch victor/35447-error-translating-cpe

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR fixes unnecessary error logging that occurred when no CPE (Common Platform Enumeration) match is found for certain software items like VSCode extensions and JetBrains plugins. Previously, these cases were logged as errors with "error translating to CPE, skipping" messages, even though not finding a CPE match is a normal and expected outcome for software that doesn't have corresponding entries in the NVD CPE dictionary.

Changes:

• Modified error handling in CPEFromSoftware to treat sql.ErrNoRows as a normal "no match" case rather than an error
• Added changelog entry documenting the fix

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
server/vulnerabilities/nvd/cpe.go	Added check to return empty string instead of error when no CPE database row is found
changes/35447-fix-cpe-translation-error-logging	Added user-visible changelog entry describing the fix

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This error check uses errors.Is(err, sql.ErrNoRows) which is the more robust approach for error checking. However, there are two other instances in this same function (lines 552 and 614) that use direct comparison err == sql.ErrNoRows. For consistency and best practice, those should also use errors.Is(). While sql.ErrNoRows is a sentinel error that can be compared directly, using errors.Is() is more future-proof and follows Go best practices for error checking.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.07%. Comparing base (ef76a87) to head (a822a09).
⚠️ Report is 26 commits behind head on main.

Files with missing lines	Patch %	Lines
server/vulnerabilities/nvd/cpe.go	0.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #38754      +/-   ##
==========================================
- Coverage   66.07%   66.07%   -0.01%     
==========================================
  Files        2414     2414              
  Lines      192710   192715       +5     
  Branches     8488     8488              
==========================================
  Hits       127329   127329              
- Misses      53818    53819       +1     
- Partials    11563    11567       +4     

Flag	Coverage Δ
backend	67.91% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ksykulev]

Makes sense.

[ksykulev]

if errors.Is(err, sql.ErrNoRows) {
    level.Debug(logger).Log("msg", "no CPE found in database", "software", software.Name)
    return "", nil
}

Any chance we want to have this log at debug? although I don't think it's necessary...