fixup

Author: santigimeno

dep_checker/npm_audit.py

@@ -332,8 +332,7 @@ def merge_vulnerability(vuln) -> None:
                     return
             vulnerabilities_by_id[vuln.id] = vuln
 
-        packages_needing_repo_fallback: list[Dict[str, str]] = []
-        packages_with_cve_match: set[tuple[str, str]] = set()
+        packages_for_repo_advisories = list(packages)
         if self.gh_token is not None:
             transport = AIOHTTPTransport(
                 url="https://api.github.com/graphql",
@@ -347,8 +346,6 @@ def merge_vulnerability(vuln) -> None:
             )
 
             for package in packages:
-                matched_this_package = False
-                has_cve_match = False
                 try:
                     result = client.execute(
                         github_vulnerabilities_query,
@@ -358,7 +355,6 @@ def merge_vulnerability(vuln) -> None:
                     logger.warning(
                         f"Skipping GitHub advisory query for {package['name']}@{package['version']}: {exc}"
                     )
-                    packages_needing_repo_fallback.append(package)
                     continue
                 for vuln in result["securityVulnerabilities"]["nodes"]:
                     if vuln["advisory"]["withdrawnAt"] is not None:
@@ -375,11 +371,7 @@ def merge_vulnerability(vuln) -> None:
                             f"Skipping advisory match for {package['name']}@{package['version']}: {exc}"
                         )
                         continue
-                    matched_this_package = True
                     preferred_id = self.preferred_advisory_id(vuln["advisory"])
-                    if preferred_id.startswith("CVE-"):
-                        has_cve_match = True
-                        packages_with_cve_match.add((package["name"], package["version"]))
                     merge_vulnerability(
                         vulnerability_class(
                             id=preferred_id,
@@ -395,12 +387,7 @@ def merge_vulnerability(vuln) -> None:
                             advisory_aliases=self.advisory_aliases(vuln["advisory"], preferred_id),
                         )
                     )
-                if not matched_this_package or not has_cve_match:
-                    packages_needing_repo_fallback.append(package)
-        else:
-            packages_needing_repo_fallback = list(packages)
-
-        for package in packages_needing_repo_fallback:
+        for package in packages_for_repo_advisories:
             try:
                 for vuln in self.query_repository_advisory_vulnerabilities(package_dir, package):
                     merge_vulnerability(

dep_checker/test_npm_audit.py

@@ -373,10 +373,30 @@ def execute(self, query, variable_values):
         npm_audit.searchCVE = original_search
 
 
-def test_repository_advisory_fallback_discovers_package_cve() -> None:
+def test_repository_advisories_are_merged_with_ghad_results() -> None:
     class FakeClient:
         def execute(self, query, variable_values):
-            return {"securityVulnerabilities": {"nodes": []}}
+            return {
+                "securityVulnerabilities": {
+                    "nodes": [
+                        {
+                            "severity": "MODERATE",
+                            "vulnerableVersionRange": ">=10.1.1, <=10.2.0",
+                            "firstPatchedVersion": {"identifier": "10.2.1"},
+                            "advisory": {
+                                "ghsaId": "GHSA-22jq-vg5j-6vgg",
+                                "identifiers": [
+                                    {"type": "GHSA", "value": "GHSA-22jq-vg5j-6vgg"},
+                                    {"type": "CVE", "value": "CVE-2026-54272"},
+                                ],
+                                "permalink": "https://github.com/advisories/GHSA-22jq-vg5j-6vgg",
+                                "summary": "ip-address mapped/NAT64 bypass",
+                                "withdrawnAt": None,
+                            },
+                        }
+                    ]
+                }
+            }
 
     class FakeResponse:
         def __enter__(self):
@@ -387,12 +407,32 @@ def __exit__(self, exc_type, exc, tb):
 
         def read(self):
             return json.dumps([
+                {
+                    "ghsa_id": "GHSA-mwp4-54f8-5fhr",
+                    "cve_id": "CVE-2026-69192",
+                    "html_url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-mwp4-54f8-5fhr",
+                    "severity": "high",
+                    "summary": "ip-address leading-zero octet parsing bypass",
+                    "state": "published",
+                    "withdrawn_at": None,
+                    "identifiers": [
+                        {"type": "GHSA", "value": "GHSA-mwp4-54f8-5fhr"},
+                        {"type": "CVE", "value": "CVE-2026-69192"},
+                    ],
+                    "vulnerabilities": [
+                        {
+                            "package": {"ecosystem": "npm", "name": "ip-address"},
+                            "vulnerable_version_range": "<=10.3.0",
+                            "patched_versions": "10.3.1",
+                        }
+                    ],
+                },
                 {
                     "ghsa_id": "GHSA-4xrf-jv44-h6hh",
                     "cve_id": "CVE-2026-69198",
                     "html_url": "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh",
                     "severity": "medium",
-                    "summary": "ip-address SSRF classification bypass",
+                    "summary": "ip-address CIDR suffix bypass",
                     "state": "published",
                     "withdrawn_at": None,
                     "identifiers": [
@@ -402,11 +442,11 @@ def read(self):
                     "vulnerabilities": [
                         {
                             "package": {"ecosystem": "npm", "name": "ip-address"},
-                            "vulnerable_version_range": ">=10.1.1, <10.2.2",
+                            "vulnerable_version_range": ">=10.1.1, <=10.2.1",
                             "patched_versions": "10.2.2",
                         }
                     ],
-                }
+                },
             ]).encode()
 
     original_client = npm_audit.Client
@@ -430,10 +470,8 @@ def read(self):
                 [{"name": "ip-address", "version": "10.2.0", "path": "node_modules/ip-address"}],
                 Vulnerability,
             )
-            assert len(vulns) == 1, vulns
-            assert vulns[0].id == "CVE-2026-69198"
-            assert vulns[0].advisory_aliases == ["GHSA-4xrf-jv44-h6hh"]
-            assert vulns[0].url == "https://github.com/beaugunderson/ip-address/security/advisories/GHSA-4xrf-jv44-h6hh"
+            ids = sorted(v.id for v in vulns)
+            assert ids == ["CVE-2026-54272", "CVE-2026-69192", "CVE-2026-69198"], vulns
     finally:
         npm_audit.Client = original_client
         npm_audit.AIOHTTPTransport = original_transport
@@ -707,7 +745,7 @@ def test_npm_audit_basic() -> None:
     test_enolock_with_node_modules_still_falls_back()
     test_enolock_falls_back_to_install_and_normal_audit()
     test_nvd_primary_merges_ghad_aliases()
-    test_repository_advisory_fallback_discovers_package_cve()
+    test_repository_advisories_are_merged_with_ghad_results()
     test_query_failure_is_skipped_per_package()
     test_invalid_advisory_range_or_version_is_skipped()
     test_normalize_npm_advisory_id()