[Pre537] Omit or replace patched_versions field during lib/github_advisory_sync.rb run if it was never patched

[jasnow]

Omit or replace patched_versions field during lib/github_advisory_sync.rb run if it was never patched.
Currently, here is the the results of lib/github_advisory_sync.rb script:

gems/arabic-prawn/CVE-2014-2322.yml:patched_versions:
gems/arabic-prawn/CVE-2014-2322.yml-- ">= "

Normally I add a notes: "ever patched" where patched_versions would be if never patched.

[jasnow]

Probably overlaps some with #157.

[postmodern]

@jasnow if there's no patched-versions, would you prefer that the patched_versions: be omitted entirely, or left empty?

[jasnow]

@jasnow if there's no patched-versions, would you prefer that the patched_versions: be omitted entirely, or left empty?

My vote for no patched_version: value is to replace it with:

notes: "Never patched"

so the future me will know explicitly that someone checked and did not find a patched version.

[jasnow]

My vote for no patched_version: value is to replace it with:

notes: "Never patched"

Sort of like the way cvss_v3 is implemented:

 "cvss_v3"             => ("<FILL IN IF AVAILABLE>" unless cvss),

[postmodern]

#664 should resolve this.

[jasnow]

#664 should resolve this.

Agree