google / google/osv.dev

Advisories deleted from source Git repository not being marked as withdrawn

Open
#2,101 1 comment 0 reactions 0 assignees View on GitHub
backlog data quality
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
Whilst doing some validation analysis for https://github.com/bitnami/vulndb/issues/336 I noticed that records now showing as deleted are not marked as withdrawn in OSV.dev

Then I remembered https://github.com/google/osv.dev/pull/829 removed this behaviour due to some sort of blip at the time in the GitHub Advisory Database, whereas a safer approach would be to do a threshold-based operation like what's being done for GCS in #2030

**Expected behaviour**
I was of the expectation that deleted records were marked as withdrawn and that Git-based source imports would catch up to the commits deleting a record

**Additional context**

- https://github.com/google/osv.dev/pull/829

- https://osv.dev/vulnerability/BIT-typo3-2023-47127
- https://github.com/bitnami/vulndb/tree/main/data/typo3/BIT-typo3-2023-47127.json
- https://github.com/bitnami/vulndb/commit/54689e91d8a5a27b46c914e2d67b68dc1304ddae

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.