Correlate Go vulnerabilities when OSS Index normalizes version prefix by jha-pravin · Pull Request #7757 · DependencyTrack/dependency-track

jha-pravin · 2026-10-24T06:56:40Z

Description

Fixes an issue where the OSS Index vulnerability analyzer drops vulnerability findings for Go packages when OSS Index returns coordinates with a normalized version prefix (e.g., pkg:golang/golang.org/x/text@v0.3.5 in response to submitted pkg:golang/golang.org/x/text@0.3.5).

Previously, OssIndexVulnAnalyzer performed only exact string matching between submitted PURL coordinates and returned report coordinates. When coordinates differed due to version prefix normalization, DT logged a warning that vulnerabilities were received for an unsubmitted PURL, dropped the findings, and stored a negative cache entry under the submitted PURL.

This PR implements two-pass correlation following maintainer guidance:

Exact string coordinate matching first.
Version-aware matching for unmatched entries using versatile (VersionFactory.forScheme(...) / KnownVersioningSchemes), which treats Go versions with and without the v prefix as equal.
Results are cached under both the submitted PURL and the report coordinates so that neither entry suffers from false negative cache poisoning.

Addressed Issue

Fixes #7739

Additional Details

Added dependency io.github.nscuro:versatile-core to vuln-analysis/oss-index/pom.xml (version managed in parent POM).
Added arePurlsEquivalent helper in OssIndexVulnAnalyzer checking type, namespace, name, subpath, qualifiers, and version equality via versatile.
Stored reports in entriesToCache under both submitted PURL and returned report coordinates.
Added comprehensive unit tests in OssIndexVulnAnalyzerTest:
- shouldCorrelateGoVulnerabilitiesWhenOssIndexNormalizesVersionWithPrefix: verifies correlation, VDR bom-ref attachment, and subsequent cache hits for both submitted and returned coordinates.
- shouldCacheNegativeResultWhenGoComponentHasNoVulnerabilitiesAndOssIndexNormalizesVersion: verifies negative caching behavior when no vulnerabilities are present.

Checklist

I have read and understand the contributing guidelines
This PR fixes a defect, and I have provided tests to verify that the fix is effective
This PR implements an enhancement, and I have provided tests to verify that it works as intended
This PR introduces changes to the database model, and I have updated the migration changelog accordingly
This PR introduces new or alters existing behavior, and I have updated the documentation accordingly
This PR is a substantial change (per the ADR criteria), and I have added an ADR under docs/adr/

When querying OSS Index for Go packages without a 'v' prefix (e.g., pkg:golang/golang.org/x/text@0.3.5), OSS Index returns component reports where coordinates have been normalized with a 'v' prefix (e.g., pkg:golang/golang.org/x/text@v0.3.5). Previously, the OSS Index analyzer relied only on exact string matching between submitted PURL coordinates and returned coordinates. Because the coordinates differed, findings were dropped, a warning was logged indicating no component with that PURL was submitted, and a negative cache entry was written under the submitted PURL. Implement two-pass correlation in OssIndexVulnAnalyzer: 1. Exact coordinate matching pass. 2. Version-aware matching pass for unmatched entries using versatile (which ignores 'v' prefixes in Go versions). Cache results under both the submitted PURL and the returned coordinates, preventing false-negative cache poisoning. Fixes DependencyTrack#7739 Signed-off-by: Pravin Jha <83289698+jha-pravin@users.noreply.github.com>

codacy-production · 2026-10-24T06:58:00Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 22 complexity

Metric Results

Complexity 22

View in Codacy

🟢 Coverage ∅ diff coverage · +0.01% coverage variation

Metric Results

Coverage variation ✅ +0.01% coverage variation (-1.00%)

Diff coverage ∅ diff coverage (70.00%)

View coverage diff in Codacy

Coverage variation details

Coverable lines Covered lines Coverage

Common ancestor commit (b9dcc89) Report Missing Report Missing Report Missing

Head commit (6285d1b) 45991 (+51) 40394 (+49) 87.83% (+0.01%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

Coverable lines Covered lines Diff coverage

Pull request (#7757) 0 0 ∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

nscuro · 2026-10-25T09:51:10Z

+        final String scheme = KnownVersioningSchemes.fromPurlType(purl1.getType())
+                .orElse(
+                        PackageURL.StandardTypes.GOLANG.equals(purl1.getType())
+                                ? KnownVersioningSchemes.SCHEME_GOLANG
+                                : null);


The GOLANG fallback is dead code, versatile already does exactly this.

nscuro · 2026-10-25T09:52:00Z

+    private static boolean areSubpathsEqual(final @Nullable String s1, final @Nullable String s2) {
+        final String n1 = (s1 == null || s1.isEmpty()) ? null : s1;
+        final String n2 = (s2 == null || s2.isEmpty()) ? null : s2;
+        return Objects.equals(n1, n2);
+    }
+
+    private static boolean areQualifiersEqual(
+            final @Nullable Map<String, String> q1, final @Nullable Map<String, String> q2) {
+        if ((q1 == null || q1.isEmpty()) && (q2 == null || q2.isEmpty())) {
+            return true;
+        }
+        return Objects.equals(q1, q2);
+    }


These do nothing. Subpaths and qualifiers are already dropped in collectAnalyzablePurls.

nscuro · 2026-10-25T09:52:39Z

+    private static boolean areNamespacesEqual(final @Nullable String n1, final @Nullable String n2) {
+        final String s1 = (n1 == null || n1.isEmpty()) ? null : n1;
+        final String s2 = (n2 == null || n2.isEmpty()) ? null : n2;
+        return Objects.equals(s1, s2);
+    }


Objects.equals over both namespaces would suffice, no need for custom equality logic.

nscuro · 2026-10-25T09:56:01Z

+                    if (report.coordinates() != null && !report.coordinates().equals(submittedPurl)) {
+                        entriesToCache.put(report.coordinates(), serializedBytes);
+                    }


Caching by both submitted and reported PURLs is purely speculative and adds storage overhead without proven benefit. Only cache by submitted PURL, like before.

nscuro · 2026-10-25T10:06:41Z

+                    try {
+                        entriesToCache.put(
+                                report.coordinates(), objectMapper.writeValueAsBytes(report.vulnerabilities()));
+                    } catch (IOException e) {
+                        LOGGER.warn(
+                                "Failed to serialize component report for PURL '{}'; Skipping cache",
+                                report.coordinates(),
+                                e);
+                    }
+                } else {
+                    entriesToCache.put(report.coordinates(), null);


The caching part here should go, see comment above.

- Remove redundant GOLANG scheme fallback in KnownVersioningSchemes.fromPurlType - Drop unused subpath and qualifier equality checks - Use standard Objects.equals for namespace comparison - Cache reports only by submitted PURL Signed-off-by: Pravin Jha <83289698+jha-pravin@users.noreply.github.com>

nscuro requested changes Oct 25, 2026

View reviewed changes

Navigation Menu

Repository navigation

Correlate Go vulnerabilities when OSS Index normalizes version prefix - #7757

Correlate Go vulnerabilities when OSS Index normalizes version prefix#7757
jha-pravin wants to merge 2 commits into
DependencyTrack:mainfrom
jha-pravin:feature/oss-index-go-version-normalization

jha-pravin commented Oct 24, 2026

Uh oh!

codacy-production Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

nscuro Oct 25, 2026

Uh oh!

nscuro Oct 25, 2026

Uh oh!

nscuro Oct 25, 2026

Uh oh!

nscuro Oct 25, 2026

Uh oh!

nscuro Oct 25, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

jha-pravin commented Oct 24, 2026

Description

Addressed Issue

Additional Details

Checklist

Uh oh!

codacy-production Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Up to standards ✅

Uh oh!

nscuro Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

nscuro Oct 25, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codacy-production Bot commented Oct 24, 2026 •

edited

Loading