Do not coerce ECOSYSTEM to SEMVER for ecosystems that do not strictly adhere to SEMVER
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 369
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 149
Description
**Describe the bug**
OSV.dev coerces to SEMVER records it imports for specific ecosystems, regardless of what version type the source has published, e.g. GitHub Advisory Database and the Go ecosystem
**To Reproduce**
Compare and contrast:
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-mwwc-3jv2-62j3/GHSA-mwwc-3jv2-62j3.json
- https://api.osv.dev/v1/vulns/GHSA-mwwc-3jv2-62j3
**Expected behaviour**
A record's `type` field is preserved as published
**Screenshots**
Compare and contrast:
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-mwwc-3jv2-62j3/GHSA-mwwc-3jv2-62j3.json
- https://api.osv.dev/v1/vulns/GHSA-mwwc-3jv2-62j3
**Additional context**
Credit to @Churro for surfacing this:
- https://gist.github.com/Churro/976f3161f3b911b88d049fa9f4a37256
- https://gist.github.com/Churro/dc84f10ad69536ae19af9f9c53ba219d
- https://gist.github.com/Churro/304facf9f87d7fba38ad9363eb2d3772
Contributor guide
Assessment
This issue has not been assessed yet.