feat: order affected ranges as they are in the version constraint

Author: G-Rath

advisories/core/osv-sa-core-2023-005.json

@@ -31,6 +31,48 @@
             "constraint": "<7.96.0"
           }
         },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.4.0"
+            },
+            {
+              "fixed": "9.4.14"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">=9.4.0 <9.4.14"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "9.5.0"
+            },
+            {
+              "fixed": "9.5.8"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">=9.5.0 <9.5.8"
+          }
+        },
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "10.0.0"
+            },
+            {
+              "fixed": "10.0.8"
+            }
+          ],
+          "database_specific": {
+            "constraint": ">=10.0.0 <10.0.8"
+          }
+        },
         {
           "type": "ECOSYSTEM",
           "events": [
@@ -226,48 +268,6 @@
           "database_specific": {
             "constraint": "9.3.*"
           }
-        },
-        {
-          "type": "ECOSYSTEM",
-          "events": [
-            {
-              "introduced": "9.4.0"
-            },
-            {
-              "fixed": "9.4.14"
-            }
-          ],
-          "database_specific": {
-            "constraint": ">=9.4.0 <9.4.14"
-          }
-        },
-        {
-          "type": "ECOSYSTEM",
-          "events": [
-            {
-              "introduced": "9.5.0"
-            },
-            {
-              "fixed": "9.5.8"
-            }
-          ],
-          "database_specific": {
-            "constraint": ">=9.5.0 <9.5.8"
-          }
-        },
-        {
-          "type": "ECOSYSTEM",
-          "events": [
-            {
-              "introduced": "10.0.0"
-            },
-            {
-              "fixed": "10.0.8"
-            }
-          ],
-          "database_specific": {
-            "constraint": ">=10.0.0 <10.0.8"
-          }
         }
       ],
       "database_specific": {

advisories/eca/osv-sa-contrib-2025-031.json

@@ -35,42 +35,42 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "1.2.0"
+              "introduced": "2.0.0"
             },
             {
-              "fixed": "1.3.0"
+              "fixed": "2.0.16"
             }
           ],
           "database_specific": {
-            "constraint": "1.2.*"
+            "constraint": ">=2.0.0 <2.0.16"
           }
         },
         {
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.0.0"
+              "introduced": "2.1.0"
             },
             {
-              "fixed": "2.0.16"
+              "fixed": "2.1.7"
             }
           ],
           "database_specific": {
-            "constraint": ">=2.0.0 <2.0.16"
+            "constraint": ">=2.1.0 <2.1.7"
           }
         },
         {
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.1.0"
+              "introduced": "1.2.0"
             },
             {
-              "fixed": "2.1.7"
+              "fixed": "1.3.0"
             }
           ],
           "database_specific": {
-            "constraint": ">=2.1.0 <2.1.7"
+            "constraint": "1.2.*"
           }
         }
       ],

advisories/panels/osv-sa-contrib-2025-033.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.3.0",
   "id": "OSV-SA-CONTRIB-2025-033",
-  "modified": "2025-04-10T05:49:13.000Z",
+  "modified": "2025-04-29T19:18:22.000Z",
   "published": "2025-04-10T05:04:56.000Z",
   "aliases": [
     "CVE-2025-3474"

advisories/persistent_login/osv-sa-contrib-2024-044.json

@@ -35,42 +35,42 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.0.0"
+              "introduced": "2.2.0"
             },
             {
-              "fixed": "2.1.0"
+              "fixed": "2.2.2"
             }
           ],
           "database_specific": {
-            "constraint": "2.0.*"
+            "constraint": ">=2.2.0 <2.2.2"
           }
         },
         {
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.1.0"
+              "introduced": "2.0.0"
             },
             {
-              "fixed": "2.2.0"
+              "fixed": "2.1.0"
             }
           ],
           "database_specific": {
-            "constraint": "2.1.*"
+            "constraint": "2.0.*"
           }
         },
         {
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.2.0"
+              "introduced": "2.1.0"
             },
             {
-              "fixed": "2.2.2"
+              "fixed": "2.2.0"
             }
           ],
           "database_specific": {
-            "constraint": ">=2.2.0 <2.2.2"
+            "constraint": "2.1.*"
           }
         }
       ],

scripts/generate_osv_advisories.py

@@ -291,56 +291,11 @@ def build_affected_ranges(sa_advisory: drupal.Advisory) -> list[osv.Range]:
       'field_affected_versions must be present to determine affected ranges'
     )
 
-  ranges = [
+  return [
     build_affected_range(constraint.strip())
     for constraint in sa_advisory['field_affected_versions'].split('||')
   ]
 
-  return sorted(
-    ranges,
-    key=lambda ran: (event_to_semver_for_sorting(ran['events'][0])),
-  )
-
-
-def event_to_semver_for_sorting(event: osv.Event) -> semver.Version:
-  version = '0.0.0'
-  if 'introduced' in event:
-    version = event['introduced']
-  elif 'fixed' in event:
-    version = event['fixed']
-  return semver.Version.parse(semver_for_sorting(version))
-
-
-def semver_for_sorting(semver: typing.Any) -> str:
-  decrement_semver = False
-  if semver == '':
-    return ''
-  # Check if the semver string starts with a '<' character.
-  if semver[0] == '<':
-    decrement_semver = True
-    semver = semver[1:]
-  semver = semver.strip().split('.')
-  # sanity check the length of the introduced value.
-  while len(semver) < 3:
-    semver.append('0')
-
-  for i in range(3):
-    if semver[i].isnumeric():
-      semver[i] = int(semver[i])
-    else:
-      semver[i] = 0
-
-  if decrement_semver:
-    if semver[2] > 0:
-      semver[2] -= 1
-    elif semver[1] > 0:
-      semver[1] -= 1
-
-  semver_major = semver[0]
-  semver_minor = semver[1]
-  semver_patch = semver[2]
-  return f'{semver_major}.{semver_minor}.{semver_patch}'
-
 
 def get_credits_from_sa(credits: drupal.RichTextField) -> list[osv.Credit]:
   credit_list: list[osv.Credit] = []