feat: capture any warnings as part of the advisories

advisories/acquia_dam/osv-sa-contrib-2024-025.json

@@ -42,7 +42,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=1.1.0 <1.1.0-beta3"
+            "constraint": ">=1.1.0 <1.1.0-beta3",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/ai/osv-sa-contrib-2025-003.json

@@ -28,7 +28,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">1.0.0 <1.0.2"
+            "constraint": ">1.0.0 <1.0.2",
+            "warnings": [
+              "the > operator should be avoided as it does not provide a concrete version"
+            ]
           }
         }
       ],

advisories/core/osv-sa-core-2022-002.json

@@ -26,7 +26,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">7.0 <=7.86"
+            "constraint": ">7.0 <=7.86",
+            "warnings": [
+              "the > operator should be avoided as it does not provide a concrete version"
+            ]
           }
         }
       ],

advisories/diff/osv-sa-contrib-2024-042.json

@@ -42,7 +42,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=2.0.0 <2.0.0-beta3"
+            "constraint": ">=2.0.0 <2.0.0-beta3",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/jsonapi/osv-sa-contrib-2019-019.json

@@ -37,7 +37,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=2.0.0 >2.3.0"
+            "constraint": ">=2.0.0 >2.3.0",
+            "warnings": [
+              "the > operator should not be used for the second part"
+            ]
           }
         }
       ],

advisories/protected_pages/osv-sa-contrib-2023-013.json

@@ -26,7 +26,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "<1.06"
+            "constraint": "<1.06",
+            "warnings": [
+              "components should not be prefixed with leading zeros"
+            ]
           }
         }
       ],

advisories/social/osv-sa-contrib-2024-004.json

@@ -28,7 +28,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "<12.05"
+            "constraint": "<12.05",
+            "warnings": [
+              "components should not be prefixed with leading zeros"
+            ]
           }
         }
       ],

advisories/social/osv-sa-contrib-2024-038.json

@@ -56,7 +56,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=13.0.0 <13.0.0-alpha11"
+            "constraint": ">=13.0.0 <13.0.0-alpha11",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/svg_formatter/osv-sa-contrib-2022-028.json

@@ -40,7 +40,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "=2.0.0"
+            "constraint": "=2.0.0",
+            "warnings": [
+              "the = operator is not real, and will be treated as an exact version"
+            ]
           }
         }
       ],

advisories/symfony_mailer/osv-sa-contrib-2023-031.json

@@ -40,7 +40,10 @@
             }
           ],
           "database_specific": {
-            "constraint": ">=1.3.0 <1.3.0-rc3"
+            "constraint": ">=1.3.0 <1.3.0-rc3",
+            "warnings": [
+              "stability does not make sense, using -dev instead"
+            ]
           }
         }
       ],

advisories/tfa/osv-sa-contrib-2023-030.json

@@ -26,7 +26,10 @@
             }
           ],
           "database_specific": {
-            "constraint": "^1 <= 1.0.0"
+            "constraint": "^1 <= 1.0.0",
+            "warnings": [
+              "the ^ operator should not be paired with a second part"
+            ]
           }
         }
       ],

scripts/generate_osv_advisories.py

@@ -276,14 +276,19 @@ def parse_version_constraint(
 
 
 def build_affected_range(constraint: str) -> osv.Range:
-  events, _warnings = parse_version_constraint(constraint)
+  events, warnings = parse_version_constraint(constraint)
 
-  return {
+  ran: osv.Range = {
     'type': 'ECOSYSTEM',
     'events': events,
     'database_specific': {'constraint': constraint},
   }
 
+  if len(warnings) > 0:
+    ran['database_specific']['warnings'] = warnings
+
+  return ran
+
 
 def build_affected_ranges(sa_advisory: drupal.Advisory) -> list[osv.Range]:
   if sa_advisory['field_affected_versions'] is None: