From 73f14e4046e9b0a11ddb8b67d24823339778432c Mon Sep 17 00:00:00 2001 From: Hayley Denbraver Date: Wed, 12 Jul 2023 17:31:46 +0000 Subject: [PATCH] addressing comments Signed-off-by: Hayley Denbraver --- docs/schema.md | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/docs/schema.md b/docs/schema.md index 44c3b238..bf50aa01 100644 --- a/docs/schema.md +++ b/docs/schema.md @@ -865,8 +865,8 @@ branch -- each expands the scope of the git commit graph to cover. Note that we did not specify a `fixed` event here as `limit` makes it redundant. #### `last_affected` vs `fixed` example -The difference between `last_affected` and `fixed` is subtle and these examples will -clarify the use of these fields. +The difference between last_affected and fixed has additional implications around +false negatives. These examples will clarify the difference between these fields. The following example expresses that the vulnerability is present in all versions of the package, up to and including version `2.1.214`. Versions above `2.1.214` are @@ -874,14 +874,13 @@ assumed to be free from the vulnerability, but there is a potential for a false negative. The `last_affected` field is typically assigned at the time of discovery and assumes the vulnerability will be addressed in the following version. - ```json "ranges":[ { - "type":"ECOSYSTEM", - "events": [ - {"introduced":"0"}, - {"last_affected":"2.1.214"} - ] + "type":"ECOSYSTEM", + "events": [ + { "introduced": "0" }, + { "last_affected": "2.1.214" }, + ] } ] ```