Summary

Fixes issue #528 by updating the OSV report generation logic to use "0" instead of "0.0.0" as the fallback value for the 'introduced' version when empty, ensuring compliance with the OSV schema.

Problem

The current implementation in pkg/malysis/ossf.go sets the fallback value for the OSV vulnerability 'introduced' version to "0.0.0" when no explicit version is provided. According to the OSV (Open Source Vulnerability) schema specification, the correct fallback value should be "0", which represents "the vulnerability is present from the beginning of the version history".

Changes

Code Changes

• pkg/malysis/ossf.go: Changed fallback value from "0.0.0" to "0" on line 70
• Updated the accompanying comment to reference OSV schema compliance

Test Changes

• pkg/malysis/ossf_test.go: Added new test case default_introduced_version_should_be_'0'_not_'0.0.0'
• Test validates that when VersionIntroduced is empty, the generated OSV report uses "0" as the introduced version
• Verifies the complete OSV JSON structure and specifically checks the vuln.Affected[0].Ranges[0].Events[0].Introduced field

Before/After

Before:

if versionIntroduced == "" {
    // Fallback to the special version "0.0.0" which means all versions
    // of the package is likely malicious
    versionIntroduced = "0.0.0"
}

After:

if versionIntroduced == "" {
    // Fallback to the special version "0" which means all versions
    // of the package is likely malicious, as per OSV schema
    versionIntroduced = "0"
}

Verification

• ✅ All existing tests continue to pass
• ✅ New test passes, confirming the fix works correctly
• ✅ Manual verification shows generated OSV reports now use "0" as the fallback
• ✅ Explicit version parameters are still preserved correctly (backward compatibility maintained)

Impact

This is a minimal, surgical change that:

• Ensures OSV schema compliance
• Maintains full backward compatibility for explicit version specifications
• Does not affect any other functionality
• Improves interoperability with OSV-compliant vulnerability databases

The change only affects the default fallback behavior when no VersionIntroduced is explicitly provided in the OpenSSFMaliciousPackageReportParams.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.