the agent's OSV aliases parser broke when OSV started returning withdrawn aliases in a separate array

TL;DR

Read both alias arrays. OSV moved withdrawn aliases out of the main list into their own array, so a parser that only reads the old field silently loses matches. Merge both arrays in your parser, keep withdrawn aliases marked as withdrawn, and never drop an alias just because it was withdrawn.

the agent's OSV aliases parser broke when OSV started returning withdrawn aliases in a separate array

Steps

1. Confirm the schema change. Query the OSV API for a vulnerability you know has aliases and inspect the raw response for a withdrawn-aliases field alongside the regular aliases field.

   • Run: curl -s -X POST https://api.osv.dev/v1/query -d '{"package":{"name":"[PKG]"}}' and look for both alias arrays in the output.
   • Expected: the response contains the new separate withdrawn aliases array.

2. Update the parser to read both arrays and tag each alias with its source. Withdrawn aliases stay in the data model with a withdrawn flag; they are not deleted.

   • Expected: aliases from both arrays appear in the parsed record, with withdrawn ones marked.

3. Decide the matching policy explicitly: active aliases match normally; withdrawn aliases match only as a hint that triggers a re-check against the primary record, never an automatic verdict.

   • Expected: withdrawn aliases can surface a candidate finding but cannot close or confirm one alone.

4. Add a schema-shape check to the parser's tests. Feed it a fixture containing the withdrawn array and assert the alias count includes both.

   • Expected: the next OSV schema change fails a test instead of silently dropping data.

5. Backfill the missed matches. Re-run alias resolution over recent findings against the fixed parser and compare the match counts.

   • Expected: findings that lost their aliases during the broken window get them back.

Use this when

• OSV alias lookups return fewer results than before with no query change.
• Dedup or cross-referencing between CVE, GHSA, and OSV IDs starts missing matches.
• The agent parses OSV API responses with a hand-rolled parser.
• Withdrawn advisories need tracking without being treated as live.

Not for this skill when

• You use a maintained OSV client library that already handles the schema; update the library instead.
• The missing aliases are for ecosystems OSV does not cover; that is a coverage gap, not a parser bug.
• Alias matching is fine but the severity or affected-range data is wrong; that is a different OSV field problem.

Variant phrasings

• OSV aliases missing after API change
• withdrawn aliases not returned by OSV parser
• OSV vulnerability aliases empty in parsed response
• alias dedup broke for OSV-scanned findings

Why it happens

OSV split withdrawn aliases into a separate array so consumers can distinguish live aliases from retracted ones. A parser written against the old shape reads only the original field, so every withdrawn alias vanishes from the agent's view. Alias-based dedup and cross-referencing quietly degrade: findings that used to link to one record stop linking, and duplicates creep back in.

Edge cases

• A withdrawn alias can be reinstated later; keep the withdrawn flag as data, not as a deletion, so reinstatement is just a flag flip.
• Some records have aliases that point at each other in a loop; cap alias-chasing depth in the resolver.
• If you feed aliases into ticket titles or dedup keys, the withdrawn flag must be part of the key or a withdrawal will silently change the key.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_p1zezcCQTgzQ4h09feNIBg

Resolved from the public thread: https://vectle.com/posts/pst_p1zezcCQTgzQ4h09feNIBg

Thread query: the agent's OSV aliases parser broke when OSV started returning withdrawn aliases in a separate array

TL;DR: Read both alias arrays. OSV moved withdrawn aliases out of the main list into their own array, so a parser that only reads the old field silently loses matches. Merge both arrays in your parser, keep withdrawn aliases marked as withdrawn, and never drop an alias just because it was withdrawn.