osv: keep the finding when advisory detail cannot be fetched - #31
Merged
Conversation
querybatch already said the package is affected; a failed /v1/vulns/{id}
fetch used to drop the hit entirely, presenting an affected package as
clean. The hit now degrades to a skeleton advisory — ID and modified
timestamp, unknown severity, no fix version — which is what the comment
in _fetch_one always claimed happened.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
The PyPI key stringified parsed.pre, so rc10 sorted below rc2; epochs were ignored and a post-release compared equal to its base. All three feed fixed-version selection and best_match, so a wrong order picks a wrong upgrade target or denies that one exists. The key now carries the epoch (0 in the loose path, so the two stay comparable) and a numeric pre/post/dev suffix in PEP 440 order: dev < a < b < rc < final < post. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
package-lock's devOptional flag marks a package that is in the dev tree
and an optional dependency of something that ships — a production
install still gets it. Classifying it dev excluded it from the default
scan, which is the direction this tool must not fail in; it is now
optional, which is scanned by default.
yarn v1 quotes scoped packages in dependency lists ("@babel/core"
"^7.0.0"), and the field pattern could not match a quoted key, so every
@scope/ edge was silently dropped. The code even stripped quotes from a
key the regex could never capture quoted.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
_apply_management expands an import-scoped BOM through _effective, which runs _apply_management again — with no guard, a cycle of mutually importing BOMs recurses until the stack dies, and the _backfill path has no gather() around it to absorb the RecursionError, so one bad pair of POMs ended the whole scan. The import path is now threaded through the recursion and a coordinate already being expanded is skipped; the versions gathered on the way down still apply. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
Slicing "==" off a Pipfile constraint read ==2.* as the version "2.*" — a junk version OSV matches nothing against, so a real advisory range never fired — and ===2.0.0 as "=2.0.0". Both now go through the same specifier-based pin rules the requirements parser uses. uv.lock seeds used setdefault, so a package declared in several extra groups kept whichever group iterated first: listed under both docs and gui, the dev-flavoured group could hide an installable extra from the default scan. Scopes now merge to the most-included value, the same rule the graph resolver applies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
An unquoted "expires = 2026-10-27 00:00:00" arrives as a datetime, which passes isinstance(value, date) but cannot be compared against a date — so is_expired raised TypeError at matching time and took the scan down. It is now truncated to its date. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
The code pins a bare PackageReference version — matching NuGet's lowest-applicable-version restore, where the declared version is what a restore actually installs — but the comment above it still described bare versions as unpinned ranges. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
querybatch already said the package is affected; a failed /v1/vulns/{id}
fetch used to drop the hit entirely, presenting an affected package as
clean. The hit now degrades to a skeleton advisory — ID and modified
timestamp, unknown severity, no fix version — which is what the comment
in _fetch_one always claimed happened.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01WfR2EG2PFrPXF6cWzzAtPu