[help] Github Advisory GHSA-vvfq-8hwr-qm4m #3441
Description
Due to semver logic, github points out that letter versions are below the pure version, so even updating to a version that has been corrected from the precompiled ones, the github warning still continues.
Here is the mention in the Advisory documentation with an example:
Common errors
And an Advisory documentation real example similar to what happening:
Advisory with branch names in version numbers
The version range logic interprets letters after 32.0.0 as prereleases, so if you set the patched version to 32.0.0, then both 32.0.0-android and 32.0.0-jre would be incorrectly marked as vulnerable.
In detail what is happening with Advisory GHSA-vvfq-8hwr-qm4m and my understanding of it:
The warning is that versions below 1.18.3 are affected and that the fix was made in version 1.18.3. The problem is that according to Github version check (Dependabot), since it uses semver, precompiled versions mean that they were released before 1.18.3, even though they are not.
In other words, in semver format, for example, version 1.18.3-aarch64-linux-gnu is before 1.18.3.
Analyzing the situation a little more and thinking about it, I believe that the best option would be to change the "Affected versions" parameter to <= 1.18.2 and put all versions of 1.18.3 as "Patched versions", since it is not clear in the documentation, but putting only 1.18.3 may not include the precompiled versions.
Or according to the examples, it might work better to put the version that is alphabetically the first:
Affected versions: <= 1.18.2
Patched versions: 1.18.3-aarch64-linux-gnu
Here is a screenshot of my project's Github, where I have already updated the Gemfile.lock and placed the code in main, but the warning remains:
