osv-affected

Analyze affected packages and version ranges.

Trigger: mentions of affected packages, version ranges, impacted ecosystems, or determining which packages/versions are affected. Skill source: .claude/skills/osv-affected/SKILL.md

CLI

osv parse -v vulnerability.json             # Full affected details + ranges
osv filter -e PyPI vulnerability.json       # Narrow to one ecosystem
osv query --ranges vulnerability.json       # Version ranges
osv query --events vulnerability.json       # Event timeline

SDK

// Presence
v.Affected.HasEcosystem(osv.EcosystemPyPI)

// Filter
pypi := v.Affected.FilterByEcosystem(osv.EcosystemPyPI)

// Iterate ranges & events
for _, a := range v.Affected {
    if a.Package == nil {
        continue // a missing package is rare but possible on untrusted data
    }
    fmt.Println(a.Package.Ecosystem, a.Package.Name)
    for _, r := range a.Ranges {
        fmt.Println("  range type:", r.Type)   // SEMVER / ECOSYSTEM / GIT
        for _, e := range r.Events {
            // e.IsIntroduced() / IsFixed() / IsLastAffected() / IsLimit()
        }
    }
}

Structure

Affected data model

Decision tree

Range type comparison

• RangeTypeEcosystem (ECOSYSTEM) is the most common; SEMVER and GIT are less frequent.

Is my version affected? — a worked example

The versions[] list is an explicit enumeration, but real records lean on ranges[]. To answer "is X affected" from a range, resolve its events. Example: introduced: 1.2.0, fixed: 1.4.1.

versions[] and ranges[] can disagree in shape

Some records list exact affected versions[]; others give only ranges[]; many give both. Prefer ranges[] for open-ended "everything since 1.2.0" cases, and treat versions[] as the authoritative enumeration when present. Never assume one implies the other.

Notes

• RangeTypeEcosystem (ECOSYSTEM) is the most common; SEMVER and GIT are less frequent
• Event fields are mutually exclusive per event object
• affected[].severity is optional per-affected severity, separate from top-level severity

Cross-references

• [[osv-filter]] — narrow affected by ecosystem
• [[osv-query]] — extract ranges/events/maven
• OSV Schema — full type model