fix: sort "introduced 0" events before any other version

pkg/database/osv.go

@@ -90,6 +90,14 @@ func (ar AffectsRange) containsVersion(pkg internal.PackageDetails) bool {
 		a := ar.Events[i]
 		b := ar.Events[j]
 
+		if a.Introduced == "0" {
+			return true
+		}
+
+		if b.Introduced == "0" {
+			return false
+		}
+
 		return semantic.MustParse(a.version(), pkg.CompareAs).CompareStr(b.version()) < 0
 	})
 

pkg/database/osv_test.go

@@ -27,6 +27,10 @@ func expectIsAffected(t *testing.T, osv database.OSV, version string, expectAffe
 	}
 
 	if osv.IsAffected(pkg) != expectAffected {
+		if version == "" {
+			version = "<empty>"
+		}
+
 		if expectAffected {
 			t.Errorf("Expected OSV to affect package version %s but it did not", version)
 		} else {
@@ -516,6 +520,41 @@ func TestOSV_IsAffected_AffectsWithEcosystem_MultipleAffected(t *testing.T) {
 
 	// an empty version should always be treated as affected
 	expectIsAffected(t, osv, "", true)
+
+	// zeros with build strings
+	osv = buildOSVWithAffected(
+		database.Affected{
+			// golang.org/x/sys
+			Package: database.Package{Ecosystem: lockfile.NpmEcosystem, Name: "my-package"},
+			Ranges: []database.AffectsRange{
+				buildEcosystemAffectsRange(
+					database.RangeEvent{Fixed: "0.0.0-20220412211240-33da011f77ad"},
+					database.RangeEvent{Introduced: "0"},
+				),
+			},
+		},
+		database.Affected{
+			// golang.org/x/net
+			Package: database.Package{Ecosystem: lockfile.NpmEcosystem, Name: "my-package"},
+			Ranges: []database.AffectsRange{
+				buildEcosystemAffectsRange(
+					database.RangeEvent{Introduced: "0.0.0-20180925071336-cf3bd585ca2a"},
+					database.RangeEvent{Fixed: "0"},
+				),
+			},
+		},
+	)
+
+	for _, v := range []string{"0.0.0", "0.14.0"} {
+		expectIsAffected(t, osv, v, false)
+	}
+
+	for _, v := range []string{"0.0.0-20180925071336-cf3bd585ca2a"} {
+		expectIsAffected(t, osv, v, true)
+	}
+
+	// an empty version should always be treated as affected
+	expectIsAffected(t, osv, "", true)
 }
 
 func TestOSV_IsAffected_AffectsWithEcosystem_PipNamesAreNormalised(t *testing.T) {