feat: capture any warnings as part of the advisories (#46)

This will make it easier to determine when an advisory needs improving,
and to confirm when a "patch" has successfully addressed a warning,
without bloating all our advisories since the majority of them will be
warning free.

Note that I've already got fixes for the advisories with warnings in
this patch, I just want to have the warnings captured in a "before"
commit so that my follow-up patch will be ~more impressive~ show the
warnings are correctly addressed.

Author: G-Rath

advisories/acquia_dam/osv-sa-contrib-2024-025.json

@@ -42,7 +42,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=1.1.0 <1.1.0-beta3"
+            "constraint": ">=1.1.0 <1.1.0-beta3",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/ai/osv-sa-contrib-2025-003.json

@@ -28,7 +28,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">1.0.0 <1.0.2"
+            "constraint": ">1.0.0 <1.0.2",
+            "warnings": [
+              "the > operator should be avoided as it does not provide a concrete version"
+            ]
           }
         }
       ],

advisories/core/osv-sa-core-2022-002.json

@@ -26,7 +26,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">7.0 <=7.86"
+            "constraint": ">7.0 <=7.86",
+            "warnings": [
+              "the > operator should be avoided as it does not provide a concrete version"
+            ]
           }
         }
       ],

advisories/diff/osv-sa-contrib-2024-042.json

@@ -42,7 +42,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=2.0.0 <2.0.0-beta3"
+            "constraint": ">=2.0.0 <2.0.0-beta3",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/jsonapi/osv-sa-contrib-2019-019.json

@@ -37,7 +37,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=2.0.0 >2.3.0"
+            "constraint": ">=2.0.0 >2.3.0",
+            "warnings": [
+              "the > operator should not be used for the second part"
+            ]
           }
         }
       ],

advisories/protected_pages/osv-sa-contrib-2023-013.json

@@ -26,7 +26,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "<1.06"
+            "constraint": "<1.06",
+            "warnings": [
+              "components should not be prefixed with leading zeros"
+            ]
           }
         }
       ],

advisories/social/osv-sa-contrib-2024-004.json

@@ -28,7 +28,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "<12.05"
+            "constraint": "<12.05",
+            "warnings": [
+              "components should not be prefixed with leading zeros"
+            ]
           }
         }
       ],

advisories/social/osv-sa-contrib-2024-038.json

@@ -56,7 +56,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=13.0.0 <13.0.0-alpha11"
+            "constraint": ">=13.0.0 <13.0.0-alpha11",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/svg_formatter/osv-sa-contrib-2022-028.json

@@ -40,7 +40,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "=2.0.0"
+            "constraint": "=2.0.0",
+            "warnings": [
+              "the = operator is not real, and will be treated as an exact version"
+            ]
           }
         }
       ],

advisories/symfony_mailer/osv-sa-contrib-2023-031.json

@@ -40,7 +40,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=1.3.0 <1.3.0-rc3"
+            "constraint": ">=1.3.0 <1.3.0-rc3",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],