feat: rewrite affected version parser to match composer and report warnings about invalid versions (#35)

This overhauls our version constraints parser to ensure we're performing
almost in accordance with
[composer](https://getcomposer.org/doc/articles/versions.md) and with
support for surfacing warnings so that we can identify invalid versions
to get addressed upstream.

The primary difference in how we parse versions compared with `composer`
is that we assume a lack of stability constraint means `stable` in all
cases, instead of being [dependent on the
operator](https://getcomposer.org/doc/articles/versions.md#stability-constraints)
- ideally, the stability should be included as part of the constraint
which might be something we can convince the upstream to do, but for now
I've chosen to differ for a few key reasons:
1. Drupal security advisories generally only cover stable versions, so
it's reasonable to assume whoever wrote the version constraints for a
particular advisory was only thinking about stable versions
2. Being semantically correct would mean a _lot_ of changes to our
advisories
3. Ideally we want to be referring versions that actually exist, which
is most likely the case for the versions explicitly mentioned in
particular version constraints (in part because of point 1.), whereas if
we follow the spec we'd have to assume a lot of the time that there's a
`-dev` version that probably won't exist

I have done the implementation to first be spec-compliant, and then
modified it to reflect the above, meaning we should be able to easily
change back in future if needed by reviewing the last handful of commits
on this branch.

I've not actually wired anything up to use the warnings returned by the
parser given the size of this patch already, but they are asserted by
our new test suite.

There's definitely some cleanup worth doing with the implementation, in
particular I probably should have named the component properties
`major`, `minor`, and `patch`, but I'm going to try tackle most of those
as a follow-up since everything is working and renaming things might
make it harder to review the individual commits, and this should be
stable enough to let us progress to the next phase where we'll be
engaging with the Drupal community to improve the advisory data which
should feed back heavily into how robust this implementation actually
needs to be

Author: G-Rath

.github/workflows/ci.yml

@@ -46,6 +46,21 @@ jobs:
       - run: pipx install poetry~=2.0
       - run: poetry install
       - run: poetry run mypy .
+  pytest:
+    permissions:
+      contents: read # to fetch (actions/checkout)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version-file: '.python-version'
+      - run: pipx install poetry~=2.0
+      - run: poetry install
+      - run: poetry run pytest
   prettier:
     permissions:
       contents: read # to fetch (actions/checkout)

CONTRIBUTING.md

@@ -3,6 +3,14 @@
 This codebase requires Python 3.13 and uses [Poetry](https://python-poetry.org/)
 to manage dependencies.
 
+# Testing
+
+We use `pytest` for testing, which can be run with:
+
+```shell
+poetry run pytest
+```
+
 # Type checking
 
 We use `mypy` to do strict type checking of Python scripts, which can be run

advisories/acquia_dam/osv-sa-contrib-2024-025.json

@@ -35,7 +35,7 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "1.1.0"
+              "introduced": "1.1.0-dev"
             },
             {
               "fixed": "1.1.0-beta3"

advisories/admin_toolbar/osv-sa-contrib-2021-025.json

@@ -34,6 +34,9 @@
           "events": [
             {
               "introduced": "3.0.0"
+            },
+            {
+              "last_affected": "3.0.0"
             }
           ],
           "database_specific": {
@@ -45,6 +48,9 @@
           "events": [
             {
               "introduced": "3.0.1"
+            },
+            {
+              "last_affected": "3.0.1"
             }
           ],
           "database_specific": {

advisories/ai/osv-sa-contrib-2025-003.json

@@ -21,7 +21,7 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "1.0.0"
+              "introduced": "1.0.1"
             },
             {
               "fixed": "1.0.2"

advisories/core/osv-sa-core-2022-002.json

@@ -19,10 +19,10 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "7.0.0"
+              "introduced": "7.0.1"
             },
             {
-              "fixed": "7.86.0"
+              "last_affected": "7.86.0"
             }
           ],
           "database_specific": {

advisories/core/osv-sa-core-2023-005.json

@@ -36,6 +36,9 @@
           "events": [
             {
               "introduced": "8.0.0"
+            },
+            {
+              "fixed": "8.1.0"
             }
           ],
           "database_specific": {
@@ -47,6 +50,9 @@
           "events": [
             {
               "introduced": "8.1.0"
+            },
+            {
+              "fixed": "8.2.0"
             }
           ],
           "database_specific": {
@@ -58,6 +64,9 @@
           "events": [
             {
               "introduced": "8.2.0"
+            },
+            {
+              "fixed": "8.3.0"
             }
           ],
           "database_specific": {
@@ -69,6 +78,9 @@
           "events": [
             {
               "introduced": "8.3.0"
+            },
+            {
+              "fixed": "8.4.0"
             }
           ],
           "database_specific": {
@@ -80,6 +92,9 @@
           "events": [
             {
               "introduced": "8.4.0"
+            },
+            {
+              "fixed": "8.5.0"
             }
           ],
           "database_specific": {
@@ -91,6 +106,9 @@
           "events": [
             {
               "introduced": "8.5.0"
+            },
+            {
+              "fixed": "8.6.0"
             }
           ],
           "database_specific": {
@@ -102,6 +120,9 @@
           "events": [
             {
               "introduced": "8.6.0"
+            },
+            {
+              "fixed": "8.7.0"
             }
           ],
           "database_specific": {
@@ -113,6 +134,9 @@
           "events": [
             {
               "introduced": "8.7.0"
+            },
+            {
+              "fixed": "8.8.0"
             }
           ],
           "database_specific": {
@@ -124,6 +148,9 @@
           "events": [
             {
               "introduced": "8.8.0"
+            },
+            {
+              "fixed": "8.9.0"
             }
           ],
           "database_specific": {
@@ -135,6 +162,9 @@
           "events": [
             {
               "introduced": "8.9.0"
+            },
+            {
+              "fixed": "8.10.0"
             }
           ],
           "database_specific": {
@@ -146,6 +176,9 @@
           "events": [
             {
               "introduced": "9.0.0"
+            },
+            {
+              "fixed": "9.1.0"
             }
           ],
           "database_specific": {
@@ -157,6 +190,9 @@
           "events": [
             {
               "introduced": "9.1.0"
+            },
+            {
+              "fixed": "9.2.0"
             }
           ],
           "database_specific": {
@@ -168,6 +204,9 @@
           "events": [
             {
               "introduced": "9.2.0"
+            },
+            {
+              "fixed": "9.3.0"
             }
           ],
           "database_specific": {
@@ -179,6 +218,9 @@
           "events": [
             {
               "introduced": "9.3.0"
+            },
+            {
+              "fixed": "9.4.0"
             }
           ],
           "database_specific": {

advisories/diff/osv-sa-contrib-2024-042.json

@@ -35,7 +35,7 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.0.0"
+              "introduced": "2.0.0-dev"
             },
             {
               "fixed": "2.0.0-beta3"

advisories/domain_group/osv-sa-contrib-2021-037.json

@@ -34,6 +34,9 @@
           "events": [
             {
               "introduced": "2.0.0"
+            },
+            {
+              "last_affected": "2.0.0"
             }
           ],
           "database_specific": {

advisories/eca/osv-sa-contrib-2025-031.json

@@ -36,6 +36,9 @@
           "events": [
             {
               "introduced": "1.2.0"
+            },
+            {
+              "fixed": "1.3.0"
             }
           ],
           "database_specific": {