Function getFixedVersion

server/utils/dependency-analysis.ts:189–232

* Extract the fixed version for a specific package version from vulnerability data. * Finds all intervals that contain the current version and returns the closest fix, * preferring a nearby backport over a distant major-version bump. * @see https://ossf.github.io/osv-schema/#affectedrangesevents-

(
  affected: OsvAffected[] | undefined,
  packageName: string,
  currentVersion: string,
)

 * @see https://ossf.github.io/osv-schema/#affectedrangesevents-fields
 */
function getFixedVersion(
  affected: OsvAffected[] | undefined,
  packageName: string,
  currentVersion: string,
): string | undefined {
  if (!affected) return undefined

  // Find all affected entries for this specific package
  const packageAffectedEntries = affected.filter(
    a => a.package.ecosystem === 'npm' && a.package.name === packageName,
  )

  // Collect all matching fixed versions across all ranges
  const matchingFixedVersions: string[] = []

  for (const entry of packageAffectedEntries) {
    if (!entry.ranges) continue

    for (const range of entry.ranges) {
      // Only handle SEMVER ranges (most common for npm)
      if (range.type !== 'SEMVER') continue

      const intervals = parseRangeIntervals(range)
      for (const interval of intervals) {
        const introVersion = interval.introduced === '0' ? '0.0.0' : interval.introduced
        try {
          const afterIntro = semver.gte(currentVersion, introVersion)
          const beforeFixed = !interval.fixed || semver.lt(currentVersion, interval.fixed)
          if (afterIntro && beforeFixed && interval.fixed) {
            matchingFixedVersions.push(interval.fixed)
          }
        } catch {
          continue
        }
      }
    }
  }

  if (matchingFixedVersions.length === 0) return undefined
  if (matchingFixedVersions.length === 1) return matchingFixedVersions[0]

  // Return the lowest (closest) fixed version — the smallest bump from the current version
  return matchingFixedVersions.sort(semver.compare)[0]
}

function getSeverityLevel(vuln: OsvVulnerability): OsvSeverityLevel {
  const dbSeverity = vuln.database_specific?.severity?.toLowerCase()