Support Clojars for version enumeration

[lkoskela]

It looks like GHSA-cp4w-6x4w-v2h5 is not recognized by the OSV API for this request:

curl -X POST -d \
  '{"version": "1.13.95", "package": {"name": "lambdaisland:uri", "ecosystem": "Maven"}}' \
  "https://api.osv.dev/v1/query"

The OSV database contains introduced/fixed metadata that seems like the above curl should yield (at least) GHSA-cp4w-6x4w-v2h5 but instead I get back an empty object.

[oliverchang]

Thanks for the report!

It looks like "lambdaisland:uri" lives in the Clojars repository, which we do not index. We only index Maven Central packages for serving query responses.

I'll reword this issue to reflect this.

[marton-cf]

I've ran into the exact same issue. It's very confusing that a vulnerability that shows up in the metadata index is not returned by the API.

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

[github-actions]

This issue has not had any activity for 60 days and will be automatically closed in two weeks

See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.