data quality issues with OSEC-2026-07 OSEC-2026-12 OSEC-2026-13

[hannesm]

Describe the bug

The "Affected versions" metadata is imaging versions prefixed with v. The data source at https://github.com/ocaml/security-advisories/blob/generated-osv/2026/OSEC-2026-07.json lists the following versions:

      "versions": [
        "0.1.0",
        "0.2.0",
        "0.3.0",
        "0.4.0",
        "0.5.0",
        "0.6.0",
        "0.7.0",
        "0.7.1",
        "0.8.0",
        "0.9.0",
        "0.9.1",
        "0.9.2",
        "0.9.3",
        "0.10.1",
        "0.10.2",
        "0.10.3",
        "0.10.4",
        "0.10.5",
        "0.10.6",
        "0.11.0",
        "0.11.1",
        "0.12.0",
        "0.12.1",
        "0.12.2",
        "0.12.3",
        "0.12.4",
        "0.12.5",
        "0.12.6",
        "0.12.7",
        "0.12.8",
        "0.13.0",
        "0.13.1",
        "0.13.2",
        "0.14.0",
        "0.14.1",
        "0.15.0",
        "0.15.1",
        "0.15.2",
        "0.15.3",
        "0.15.4",
        "0.16.0",
        "0.17.0",
        "0.17.1",
        "0.17.3",
        "0.17.4",
        "0.17.5",
        "1.0.0",
        "1.0.2",
        "1.0.4",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4"
      ],

Now, the advisory at https://osv.dev/vulnerability/OSEC-2026-07 shows

 Affected versions
0.*
0.1.0
0.2.0
0.3.0
0.4.0
0.5.0
0.6.0
0.7.0
0.7.1
0.8.0
0.9.0
0.9.1
0.9.2
0.9.3
0.10.0
0.10.1
0.10.2
0.10.3
0.10.4
0.10.5
0.10.6
0.11.0
0.11.1
0.12.0
0.12.1
0.12.2
0.12.3
0.12.4
0.12.5
0.12.6
0.12.7
0.12.8
0.13.0
0.13.1
0.13.2
0.14.0
0.14.1
0.15.0
0.15.1
0.15.2
0.15.3
0.15.4
0.16.0
0.17.0
0.17.1
0.17.3
0.17.4
0.17.5
1.*
1.0.0
1.0.2
1.0.4
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
v2.*
v2.0.4
v2.0.3
v2.0.2
v2.0.1
v2.0.0
v1.*
v1.0.4
v1.0.3
v1.0.2
v1.0.1
v1.0.0
v0.*
v0.17.5
v0.17.4
v0.17.3
v0.17.2
v0.17.0
v0.16.0
v0.15.5
v0.15.4
v0.15.3
v0.15.2
v0.15.1
v0.15.0
v0.14.1
v0.14.0
v0.13.2
v0.13.1
v0.13.0
v0.12.8
v0.12.7
v0.12.6
v0.12.5
v0.12.4
v0.12.3
v0.12.2
v0.12.1
v0.12.0
v0.11.1
v0.11.0
v0.10.6
v0.10.5

(Same data in https://api.osv.dev/v1/vulns/OSEC-2026-07).

I wonder where the v prefixes are hallucinated by.

Some other advisories of the OPAM/OSEC show the same behaviour -- but not all.

[G-Rath]

Pretty sure this is the same as #5578 - if I recall my convo w/ @another-rex, this is because the git ecosystem works by tags and so that's what you're seeing in versions.

The spec technically allows this, but obviously it's not nice - I believe the fix we discussed was having an affected entry per type-of-range, so that the versions only held values that belonged to one type rather than two.

[jess-lowe]

+1 to what @G-Rath said. I will update the OSV schema docs to make this clearer :)

[jess-lowe]

raised ossf/osv-schema/pull/588 :)