Advisories deleted from source Git repository not being marked as withdrawn
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
**Describe the bug**
Whilst doing some validation analysis for https://github.com/bitnami/vulndb/issues/336 I noticed that records now showing as deleted are not marked as withdrawn in OSV.dev
Then I remembered https://github.com/google/osv.dev/pull/829 removed this behaviour due to some sort of blip at the time in the GitHub Advisory Database, whereas a safer approach would be to do a threshold-based operation like what's being done for GCS in #2030
**Expected behaviour**
I was of the expectation that deleted records were marked as withdrawn and that Git-based source imports would catch up to the commits deleting a record
**Additional context**
- https://github.com/google/osv.dev/pull/829
- https://osv.dev/vulnerability/BIT-typo3-2023-47127
- https://github.com/bitnami/vulndb/tree/main/data/typo3/BIT-typo3-2023-47127.json
- https://github.com/bitnami/vulndb/commit/54689e91d8a5a27b46c914e2d67b68dc1304ddae
Contributor guide
Assessment
This issue has not been assessed yet.