Closed
Description
It looks like currently, GHSA entries with affected versions using the "= X" operator without a patched version (e.g. GHSA-wxhq-pm8v-cw75), get converted to:
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "X"
}
]
}
],
"versions": [
"X"
] (example)
According to the OSV spec, this actually implies all versions after and including X are affected, because there is no corresponding "fixed" to end the affected range.
Would it be possible to encode such cases as just:
"versions": [
"X"
] Without the erroneous "range"?
Metadata
Metadata
Assignees
Labels
No labels