fix: filter soft-deleted advisory ranges in Tinybird join (CM-1258)

Signed-off-by: Uroš Marolt <uros@marolt.me>

Author: themarolt

services/libs/tinybird/datasources/advisoryAffectedRanges.datasource

@@ -10,6 +10,7 @@ DESCRIPTION >
     - `rangeRaw` is the raw AffectedVersions string from the deps.dev BigQuery source (empty string if OSV-sourced).
     - `unaffectedRaw` is the raw UnaffectedVersions string from deps.dev BigQuery (empty string if OSV-sourced).
     - `createdAt` and `updatedAt` are row-level audit timestamps for Tinybird watermark-based sync.
+    - `deletedAt` is set when Postgres soft-deletes the row (stale OSV tuple or superseded deps.dev raw row); NULL means live. `FINAL` alone doesn't collapse this — a soft-deleted row and its live replacement are distinct PKs, so consumers must also filter `deletedAt IS NULL` (see ADR-0001 §`advisory_affected_ranges` delete/dedup strategy, CM-1258).
 
 SCHEMA >
     `id` UInt64 `json:$.record.id`,
@@ -20,7 +21,8 @@ SCHEMA >
     `rangeRaw` String `json:$.record.range_raw` DEFAULT '',
     `unaffectedRaw` String `json:$.record.unaffected_raw` DEFAULT '',
     `createdAt` DateTime64(3) `json:$.record.created_at`,
-    `updatedAt` DateTime64(3) `json:$.record.updated_at`
+    `updatedAt` DateTime64(3) `json:$.record.updated_at`,
+    `deletedAt` Nullable(DateTime64(3)) `json:$.record.deleted_at`
 
 ENGINE ReplacingMergeTree
 ENGINE_PARTITION_KEY toYear(createdAt)

services/libs/tinybird/pipes/ossPackages_enriched.pipe

@@ -93,6 +93,7 @@ SQL >
     INNER JOIN advisoryPackages AS ap FINAL ON ap.packageId = p.id
     INNER JOIN advisories AS a FINAL ON a.id = ap.advisoryId
     INNER JOIN advisoryAffectedRanges AS aar FINAL ON aar.advisoryPackageId = ap.id
+        AND aar.deletedAt IS NULL
     LEFT JOIN
         (SELECT packageId, number, publishedAt AS introducedAt FROM versions FINAL) AS vi
         ON vi.packageId = p.id