google / google/osv.dev

Do not coerce ECOSYSTEM to SEMVER for ecosystems that do not strictly adhere to SEMVER

Open
#2,916 3 comments 2 reactions 1 assignee Claimed by @michaelkedar View on GitHub
backlog data quality
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
OSV.dev coerces to SEMVER records it imports for specific ecosystems, regardless of what version type the source has published, e.g. GitHub Advisory Database and the Go ecosystem

**To Reproduce**
Compare and contrast:
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-mwwc-3jv2-62j3/GHSA-mwwc-3jv2-62j3.json
- https://api.osv.dev/v1/vulns/GHSA-mwwc-3jv2-62j3

**Expected behaviour**
A record's `type` field is preserved as published

**Screenshots**
Compare and contrast:
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-mwwc-3jv2-62j3/GHSA-mwwc-3jv2-62j3.json
- https://api.osv.dev/v1/vulns/GHSA-mwwc-3jv2-62j3

**Additional context**
Credit to @Churro for surfacing this:
- https://gist.github.com/Churro/976f3161f3b911b88d049fa9f4a37256
- https://gist.github.com/Churro/dc84f10ad69536ae19af9f9c53ba219d
- https://gist.github.com/Churro/304facf9f87d7fba38ad9363eb2d3772

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.