vulns/osv_export: deduplicate references from OSV.dev

[andrew]

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

I used Claude Code to draft the patch and test after spotting duplicate reference URLs in Homebrew/advisory-database#24. I reviewed the diff, confirmed the OSV.dev response contains the duplicates, and checked that keying on [type, decoded_url] preserves legitimate same-URL-different-type entries in the existing advisory set.

---

brew generate-vulns-advisories copies the references array from GET https://api.osv.dev/v1/vulns/{id} verbatim into the emitted OSV record. OSV.dev merges NVD and cve.org reference lists without normalising percent-encoding, so the same URL can appear twice under the same type:

$ curl -s https://api.osv.dev/v1/vulns/CVE-2019-17362 | jq -r '.references[].url' | grep fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/

which then lands in the generated advisory (Homebrew/advisory-database#24).

This dedups on [type, URI::RFC2396_PARSER.unescape(url)] so %40/@ collapse while the same URL under distinct type values (e.g. ADVISORY vs REPORT, which OSV.dev also emits and the schema allows) is kept. RFC2396_PARSER.unescape matches existing usage in AbstractFileDownloadStrategy, leaves literal + in paths alone (Launchpad +bug/ URLs), and passes invalid %XX sequences through unchanged rather than raising.

To reproduce before this change:

$ brew generate-vulns-advisories /tmp/adv
$ jq -r '.references[].url' /tmp/adv/BREW-libtomcrypt-CVE-2019-17362.json | sort | uniq -d

[Copilot]

Pull request overview

This pull request improves the OSV export generated by brew generate-vulns-advisories by removing duplicate references entries coming from OSV.dev when the same URL appears multiple times under the same reference type due to differing percent-encoding (e.g. %40 vs @).

Changes:

• Deduplicate upstream references by [type, decoded_url], while preserving entries where the same URL appears under different type values.
• Add a focused spec that covers the percent-encoding deduplication behavior and ensures distinct types are retained.
• Tighten the spec file to # typed: strict and adjust the seed helper to avoid strict-Sorbet method signature requirements.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
Library/Homebrew/vulns/osv_export.rb	Deduplicates upstream OSV reference URLs by normalising percent-encoding for comparison while retaining type distinctions.
Library/Homebrew/test/vulns/osv_export_spec.rb	Adds coverage for the new deduplication logic and updates the spec to typecheck under typed: strict.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[MikeMcQuaid]

Nice!