Zetema
Edit
Security & privacy · A weekendAnywhere· Source · Oct 2026

Security scanners can't match some OSV vulnerability records by package URL because OSV.dev has no conversion for those ecosystems.

Developers and security teams who match their dependencies to known vulnerabilities by package URL

Where it stands

  1. Sourced (done)
  2. Kit (done)
  3. Wanted (next)
  4. Building
  5. Solved

How this problem came to be

  1. Found1 sourcegithub.com/google
  2. Quoted3 claimseach checked against its page
  3. BriefWrittenand what solved looks like
  4. Market1 signals1 reactions on the issue
  5. Kit5 steps21 tools · 6 routes
  6. People0 want0 live it · 0 would test

The problem, broken down

Who it hurts
People who use OSV.dev, an open vulnerability database, with tools that identify packages by package URL (PURL).
The moment
When a scan quietly misses a vulnerability because the record has no PURL to match on.
What people do today
Some records have PURLs only because their upstream data source supplies them.
Why it's unsolved
Ecosystems were added to OSV.dev without matching PURL conversions, and nothing checks for the gap.
What solved looks like
Each remaining ecosystem gets a PURL converter with tests using the type in the PURL spec, or is listed as having no PURL equivalent, and a test fails whenever a new ecosystem is added without either.

Evidence

Every claim is tied to the source it comes from
OSV.dev issue #2402: missing PURL converters ↗
  1. 1The issue says several OSV ecosystems were added without PURL conversions, and some records have PURLs only because the data source provides them.
  2. 2On 2026-10-09 the issue's checklist still had Android, Bioconductor, GHC, GitHub Actions, Linux and Photon OS unticked.
  3. 3The issue asks for a way to make sure conversions always exist and to explicitly define ecosystems with no PURL equivalent.

Written from the cited sources. Anything they don't say is left as a question, not a guess.

Sources

From a public page with a citation.

  1. [1]OSV.dev issue #2402: missing PURL converters
What the source says, in short

The issue says several OSV ecosystems were added without PURL conversions, and some records have PURLs only because the data source provides them. On 2026-10-09 the issue's checklist still had Android, Bioconductor, GHC, GitHub Actions, Linux and Photon OS unticked. The issue asks for a way to make sure conversions always exist and to explicitly define ecosystems with no PURL equivalent.

Forks 0

Nobody has forked this yet. Be the first.

Market read

How big this is, from the evidence

  • GitHub ↗Builders' pull · Medium confidence1 reactions on the issue

How these were measured: Total reactions on the GitHub issue, read from its API.

For whoever takes this up

The builder's path for this problem

Five steps, each with the tools that fit this problem and a word to carry with you. A starter prompt is ready to paste into any assistant.

Open the path

Discussion 0

No comments yet.