search

google / osv.dev

Open source vulnerability DB and triage service.
https://osv.dev
Apache License 2.0
1.54k stars 188 forks source link

Evaluate and enable cherrypick detection for cve-osv #2577

Open oliverchang opened 2 months ago

oliverchang commented 2 months ago

Currently, for our cve-osv source, detect_cherrypicks is off. This means that when we enumerate affected git commits, we are only considering the branches that contain the referenced fix commits.

This occasionally lead to missed matches.

We should evaluate turning on cherrypick detection for cve-osv. This has some implications:

Related issues: https://github.com/google/osv.dev/issues/2576#issuecomment-2336875125 https://github.com/google/osv.dev/issues/1910#issuecomment-1885825603

github-actions[bot] commented 2 months ago

:sparkles: Thank you for your interest in OSV.dev's data quality! :sparkles:

Please review our FAQ entry on how to most efficiently have this addressed.

github-actions[bot] commented 1 week ago

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.