fix: Improve OSV source version handling for ecosystem-specific formats by VanitasCodes · Pull Request #5503 · ossf/cve-bin-tool

VanitasCodes · 2026-01-17T08:28:03Z

Summary

Fixes incorrect handling of product versions from OSV source data by addressing ecosystem-specific version formats.

Changes

The main issue was that ecosystem-specific version strings (like Debian's 1:9.2p1-2) were being stored directly in the database, which broke version comparisons against upstream versions like 9.6p1.

This PR:

Skips Android and Linux ecosystems entirely since their version formats don't correspond to actual package versions (e.g., 12L:2022-09-01 for expat)
Normalizes Debian versions by stripping the epoch and revision (1:9.2p1-2 → 9.2p1)
Normalizes Alpine versions by stripping the release suffix (2.4.1-r0 → 2.4.1)
Prefers SEMVER ranges over ECOSYSTEM ranges when both are available
Falls back to the versions list when range events don't have fix information

Testing

Updated the existing test_format_data expectations and added two new test classes covering version normalization and ecosystem handling.

Copilot

Pull request overview

This PR fixes incorrect handling of product versions from OSV source data by addressing ecosystem-specific version formats. The main issue was that ecosystem-specific version strings (like Debian's 1:9.2p1-2) were being stored directly in the database, breaking version comparisons against upstream versions.

Changes:

Adds ecosystem filtering to skip Android and Linux ecosystems where version formats don't correspond to upstream package versions
Implements version normalization for Debian (strips epoch and revision) and Alpine (strips release suffix) formats
Fixes duplicate ranges bug by creating separate entries for each introduced/fixed pair instead of overwriting
Improves range selection logic to prefer SEMVER over ECOSYSTEM ranges and fall back to versions list when fix information is absent

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
cve_bin_tool/data_sources/osv_source.py	Implements ecosystem filtering, version normalization, and improved range handling logic
test/test_source_osv.py	Updates test expectations and adds comprehensive test coverage for version normalization and ecosystem handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cve_bin_tool/data_sources/osv_source.py

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

VanitasCodes · 2026-02-22T19:09:35Z

@ffontaine I was wondering if you could have a look at this one and see if I need to make any adjustments.

alex-ter · 2026-02-22T19:53:55Z

This should generally wait until the more foundational changes are done in #4956 and then be rebased on top of it.

ffontaine · 2026-02-28T20:10:28Z

#4956 has been merged, rebase is needed to fix conflicts

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cve_bin_tool/data_sources/osv_source.py

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cve_bin_tool/data_sources/osv_source.py

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cve_bin_tool/data_sources/osv_source.py

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

VanitasCodes · 2026-03-30T00:08:55Z

@alex-ter Ready for review.

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/test_source_osv.py

cve_bin_tool/data_sources/osv_source.py

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

cve_bin_tool/data_sources/osv_source.py

alex-ter

One minor comment inline, otherwise LGTM by inspection.

cve_bin_tool/data_sources/osv_source.py

Signed-off-by: Vishwajeet Singh <mit.vs.krishna@gmail.com>

VanitasCodes · 2026-04-06T19:43:58Z

@alex-ter Addressed the change, ready for review.

VanitasCodes · 2026-04-07T13:00:39Z

@ffontaine The CI failures here are unrelated to my changes. I only removed two redundant lines and these failures weren't present when I last pushed.

The check-spelling failure is a GitHub Actions workflow infrastructure issue. The test_refresh_nvd_json failure is caused by corrupt data on the NVD mirror. I'm unsure as to why the tests are failing.

ffontaine · 2026-04-07T13:53:27Z

To fix check-spelling, a bump to version 0.0.26 is needed (see https://docs.check-spelling.dev/Feature:-Restricted-Permissions). I'll then update your branch

Copilot AI review requested due to automatic review settings January 17, 2026 08:28

Copilot started reviewing on behalf of VanitasCodes January 17, 2026 08:28 View session

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from 7910e56 to b50e4c8 Compare January 17, 2026 08:29

Copilot AI reviewed Jan 17, 2026

View reviewed changes

cve_bin_tool/data_sources/osv_source.py Outdated Show resolved Hide resolved

cve_bin_tool/data_sources/osv_source.py Outdated Show resolved Hide resolved

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from b50e4c8 to 452cf11 Compare January 17, 2026 08:43

VanitasCodes requested a review from Copilot January 23, 2026 16:29

Copilot started reviewing on behalf of VanitasCodes January 23, 2026 16:30 View session

Copilot AI reviewed Jan 23, 2026

View reviewed changes

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from 452cf11 to 32ddfc2 Compare February 28, 2026 18:49

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch 2 times, most recently from 25772df to 6b31545 Compare March 1, 2026 10:49

VanitasCodes requested a review from Copilot March 1, 2026 10:59

Copilot started reviewing on behalf of VanitasCodes March 1, 2026 11:00 View session

Copilot AI reviewed Mar 1, 2026

View reviewed changes

cve_bin_tool/data_sources/osv_source.py Show resolved Hide resolved

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from 6b31545 to e50f6e4 Compare March 1, 2026 11:11

VanitasCodes requested a review from Copilot March 1, 2026 11:12

Copilot started reviewing on behalf of VanitasCodes March 1, 2026 11:12 View session

Copilot AI reviewed Mar 1, 2026

View reviewed changes

cve_bin_tool/data_sources/osv_source.py Outdated Show resolved Hide resolved

This was referenced Mar 9, 2026

fix: OSV source overwrites multiple affected entries and ranges #5614

Closed

fix: OSV source overwrites affected entries/ranges #5632

Merged

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from e50f6e4 to ce5bd86 Compare March 29, 2026 23:15

VanitasCodes requested a review from Copilot March 29, 2026 23:16

Copilot started reviewing on behalf of VanitasCodes March 29, 2026 23:17 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

cve_bin_tool/data_sources/osv_source.py Show resolved Hide resolved

cve_bin_tool/data_sources/osv_source.py Show resolved Hide resolved

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from ce5bd86 to f7a828f Compare March 29, 2026 23:29

VanitasCodes requested a review from Copilot March 29, 2026 23:30

Copilot started reviewing on behalf of VanitasCodes March 29, 2026 23:36 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from f7a828f to b225458 Compare March 29, 2026 23:48

VanitasCodes requested review from alex-ter and Copilot March 30, 2026 00:09

Copilot started reviewing on behalf of VanitasCodes March 30, 2026 00:09 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

test/test_source_osv.py Outdated Show resolved Hide resolved

cve_bin_tool/data_sources/osv_source.py Outdated Show resolved Hide resolved

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch 2 times, most recently from 343b3e3 to 4099e91 Compare March 30, 2026 13:56

VanitasCodes requested a review from Copilot March 30, 2026 16:06

Copilot started reviewing on behalf of VanitasCodes March 30, 2026 16:07 View session

Copilot AI reviewed Mar 30, 2026

View reviewed changes

cve_bin_tool/data_sources/osv_source.py Show resolved Hide resolved

alex-ter requested changes Apr 6, 2026

View reviewed changes

cve_bin_tool/data_sources/osv_source.py Outdated Show resolved Hide resolved

fix: improve OSV version handling for ecosystem formats

3885804

Signed-off-by: Vishwajeet Singh <mit.vs.krishna@gmail.com>

VanitasCodes force-pushed the fix/osv-ecosystem-version-handling branch from 4099e91 to 3885804 Compare April 6, 2026 19:43

VanitasCodes requested a review from alex-ter April 6, 2026 19:45

Merge branch 'main' into fix/osv-ecosystem-version-handling

ecf0b2d

Conversation

VanitasCodes commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

VanitasCodes commented Feb 22, 2026

Uh oh!

alex-ter commented Feb 22, 2026

Uh oh!

ffontaine commented Feb 28, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

VanitasCodes commented Mar 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

alex-ter left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

VanitasCodes commented Apr 6, 2026

Uh oh!

VanitasCodes commented Apr 7, 2026

Uh oh!

ffontaine commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

VanitasCodes commented Jan 17, 2026 •

edited

Loading