vulns: correct upstream fix boundaries and add reviewed overrides

[p-linnane]

brew advisory-match treated any interval's upper bound as the upstream fix version. Only an explicit fixed event is one: last_affected is an inclusive affected boundary and limit is an exclusive terminator. Vulnerability#range_status now sets fixed_in from fixed events only. This currently makes 19 BREW-* records in Homebrew/advisory-database report upstream_fixed_in: 4.0.0 for CVE-2026-44405, a paramiko version that was never a fix.

The new --overrides=<file> flag loads reviewed corrections keyed by formula plus upstream advisory id: range_state, upstream_fixed_in (an explicit null suppresses a bad upstream value), and formula-level skip: true. The schema fails closed. Overrides apply only when the flag is passed; advisory-database starts passing it in a follow-up.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Code (Opus 5) drafted the implementation and tests; I reviewed the diff, verified the new tests fail without the fix and pass with it, and ran brew lgtm --online plus targeted vulns and advisory-match specs.

---

[Copilot]

🟡 Changes recommended

SEMVER terminal ordering and false-valued YAML roots can still produce incorrect or silently disabled override behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Corrects vulnerability fix-boundary semantics and adds opt-in, reviewed advisory overrides.

Changes:

• Distinguishes explicit fixes from last_affected and limit boundaries.
• Adds validated formula/advisory overrides and CLI integration.
• Adds tests, Sorbet declarations, and shell completions.

File summaries

File	Description
Library/Homebrew/vulns/vulnerability.rb	Corrects range-terminal handling.
Library/Homebrew/vulns/match.rb	Applies overrides during matching and history decisions.
Library/Homebrew/vulns/advisory_overrides.rb	Parses and validates overrides.
Library/Homebrew/test/vulns/vulnerability_spec.rb	Tests boundary semantics.
Library/Homebrew/test/vulns/match_spec.rb	Tests matching overrides and skips.
Library/Homebrew/test/vulns/advisory_overrides_spec.rb	Tests override parsing and validation.
Library/Homebrew/test/dev-cmd/advisory-match_spec.rb	Tests CLI override behavior.
Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/advisory_match.rbi	Declares the new argument accessor.
Library/Homebrew/dev-cmd/advisory-match.rb	Adds --overrides integration.
completions/zsh/_brew	Adds zsh completion.
completions/fish/brew.fish	Adds fish completion.
completions/bash/brew	Adds Bash completion.

Review details

Files not reviewed (1)

• Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/advisory_match.rbi: File type not supported

• Files reviewed: 11/12 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Blank or null YAML currently bypasses the promised fail-closed override validation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Files not reviewed (1)

• Library/Homebrew/sorbet/rbi/dsl/homebrew/dev_cmd/advisory_match.rbi: File type not supported

• Files reviewed: 11/12 changed files
• Comments generated: 1
• Review effort level: Balanced

[MikeMcQuaid]

Thanks!