generate-vulns-advisories: derive initial fixed via FormulaVersions#23115
Merged
Conversation
For records with no existing file, walk homebrew-core git history (newest-first) via FormulaVersions and use the pkg_version at the oldest revision where the CVE still appears in resolved_ids as the `fixed` boundary, instead of the current pkg_version. Existing records preserve their on-disk ranges (per the merge behaviour in the previous commit), so this only fires once per newly-annotated (formula, CVE) pair. The FormulaVersions instance and its rev_list output are cached per formula so subsequent CVEs for the same formula reuse the ~90s path-filtered git rev-list and per-revision formula loads. OsvExport.run now runs inside the SimulateSystem block so historical loads are runner-OS-independent. Historical revisions are evaluated under the base simulation only; a resolves inside on_linux/on_intel falls through to the current pkg_version (documented; no such annotation exists in core today). Spot-checked against real homebrew-core: unzip CVE-2014-8139 -> 6.0_6 (current is 6.0_8), CVE-2022-0529 -> 6.0_8; libquicktime CVE-2016-2399 -> 1.2.4_5 (the resolves-added-later case; hand-correct to _4).
33 tasks
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves the accuracy of generated OSV advisory “fixed” boundaries when creating new advisory records (i.e., when no <id>.json already exists on disk). Instead of defaulting to the current pkg_version, it allows callers to derive the first fixed version from homebrew-core history (via FormulaVersions), while continuing to preserve existing on-disk ranges as the long-term source of truth.
Changes:
- Extend
Homebrew::Vulns::OsvExport.runto accept an optionalfirst_fixedcallback used only when generating records that don’t already exist on disk. - Thread an explicit
fixed:value throughrecord_for/affected_entryso OSV range events can reflect a derived fixed boundary. - Implement and test
GenerateVulnsAdvisories#first_fixed_version, walking formula history viaFormulaVersionsto find the oldest revision where the CVE remains resolved.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| Library/Homebrew/vulns/osv_export.rb | Adds optional first_fixed callback plumbing and supports explicit fixed boundaries when building new records. |
| Library/Homebrew/dev-cmd/generate-vulns-advisories.rb | Uses FormulaVersions history to derive an initial fixed boundary for newly written advisories. |
| Library/Homebrew/test/vulns/osv_export_spec.rb | Adds coverage for explicit fixed: handling and first_fixed invocation behavior. |
| Library/Homebrew/test/dev-cmd/generate-vulns-advisories_spec.rb | Adds unit tests for the first_fixed_version history-walk behavior and stubs FormulaVersions for other specs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
p-linnane
approved these changes
Jul 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to #23112. When
brew generate-vulns-advisorieswrites a record with no existing file on disk, derive thefixedboundary from homebrew-core git history viaFormulaVersionsinstead of using the currentpkg_version: walk newest-to-oldest and use thepkg_versionat the oldest revision where the CVE still appears inresolved_ids. Existing records preserve their on-diskranges(per #23112), so this only fires once per newly-annotated (formula, CVE) pair; a hand-corrected boundary is never recomputed.Because
resolved_idsincludes CVEs inferred from patch URLs andapplyfile paths, this finds the true fix version when the CVE is named there. When aresolvesline was added to a patch that had already shipped without a CVE reference, it finds whenresolveswas added instead (too recent); those cases are hand-corrected in the advisory repo. Historical revisions are loaded under the sameSimulateSystemas discovery so output is runner-OS-independent; aresolvesinsideon_linux/on_intelfalls through to the currentpkg_version(no such annotation exists in core today).FormulaVersions#rev_list(path-filteredgit rev-listover ~500k homebrew-core commits) is the dominant cost at ~90s per formula; the instance and its rev list are cached per formula so subsequent CVEs for the same formula are near-instant.Spot-checked against real
homebrew/core:unzip6.0_86.0_6unzip6.0_86.0_6unzip6.0_86.0_8libquicktime1.2.4_51.2.4_5(resolves-added-later case; hand-correct to_4)lrzsz0.12.20_10.12.20_1Context: Homebrew/discussions#6869, Homebrew/homebrew-brew-vulns#111.
brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?Written with Claude Code following @Bo98's suggestion on Homebrew/discussions#6869 to use
FormulaVersions, with a codex review pass that caught the runner-OS dependence and tightened the walk-termination specs. I read the diff, ranbrew lgtm, and spot-checked the derived boundaries against realhomebrew/corehistory.