aboutcode-org / aboutcode-org/vulnerablecode
Add step in ToDo computation pipeline to detect inconsistent affected and fixed versions in an advisory
Aberta
data-quality
- Linguagem predominante
- Python
- Estrelas
- 702
- Forks
- 328
- Merge médio
- 3d 8h
- PRs com merge (30d)
- 3
Descrição
Advisories like https://github.com/nodejs/security-wg/blob/main/vuln/npm/92.json contain inconsistent affected and fixed versions. Here `pkg:npm/express-restify-mongoose` is reported as both affected and fixed in version `3.0.0` which is impossible and should be detected in the ToDo pipeline for human curation.
Guia de contribuição
Nenhum guia de contribuição indexado para este repositório
Avaliação
Esta issue ainda não foi avaliada.