fix(CSAF2.0): add second level sorting criteria

lib/mandatoryTests/mandatoryTest_6_1_21.js

@@ -1,4 +1,5 @@
 import { compareZonedDateTimes } from '../shared/dateHelper.js'
+import * as docUtils from './shared/docUtils.js'
 
 /**
  * @param {unknown} doc
@@ -14,11 +15,12 @@ export default function mandatoryTest_6_1_21(doc) {
       new Set(
         doc.document.tracking.revision_history
           .slice()
-          .sort((a, z) =>
-            compareZonedDateTimes(
-              /** @type {string} */ (a.date),
-              /** @type {string} */ (z.date)
-            )
+          .sort(
+            (a, z) =>
+              compareZonedDateTimes(
+                /** @type {string} */ (a.date),
+                /** @type {string} */ (z.date)
+              ) || docUtils.compareVersions(z.number, a.number)
           )
           .map((e) =>
             // By using `parseInt` here we can deal with numeric and semantic versions

tests/csaf_2_1/mandatoryTest_6_1_21.js

@@ -0,0 +1,30 @@
+import assert from 'node:assert/strict'
+
+import { mandatoryTest_6_1_21 } from '../../csaf_2_1/mandatoryTests.js'
+
+describe('mandatoryTest_6_1_21', function () {
+  it('passes a reverse-ordered but complete revision history (2, 1)', function () {
+    // also matches the scenario from oasis_csaf_tc-csaf_2_1-2024-6-1-14-12.json
+    // which has same-date entries sorted by version number
+    const result = mandatoryTest_6_1_21({
+      document: {
+        tracking: {
+          revision_history: [
+            {
+              date: '2024-01-22T10:00:00.000Z',
+              number: '2',
+              summary: 'Second version.',
+            },
+            {
+              date: '2024-01-22T10:00:00.000Z',
+              number: '1',
+              summary: 'Initial version.',
+            },
+          ],
+        },
+      },
+    })
+    assert.equal(result.isValid, true)
+    assert.equal(result.errors.length, 0)
+  })
+})