GHSA advisories never use the OSV `FIX` reference type, though ~54% link a fix commit

まず、公開されているエコシステムごとの OSV アーカイブに対して測定を再現し、例の GHSA-35jh-r3h4-6jhm の参照を調査します。参照タイプがどのように割り当てられるかを判断するため、repository の advisory curation workflow を読みます。完了とは、maintainer が fix commit に FIX labels を付与するかどうか、および付与する場合の方法を決定し、workflow またはデータの変更内容が定義されている状態です。

Summary

Across every GHSA advisory published to the OSV feeds, the FIX reference type
is used zero times. Meanwhile about 54% of those advisories do link their fixing
commit, filed under WEB alongside vendor bulletins and NVD mirrors.

Consumers that want the fix commit therefore have to recognise it by URL shape
rather than by reading the reference type.

Measurement

Taken from the published OSV per-ecosystem archives at
https://storage.googleapis.com/osv-vulnerabilities/<ecosystem>/all.zip,
excluding withdrawn advisories. GHSA records only.

Ecosystem feed	GHSA records	FIX refs	Links a commit under another type
npm	7,020	0	3,634 (52%)
Maven	6,956	0	3,268 (47%)
Packagist	6,347	0	3,464 (55%)
PyPI	6,016	0	3,776 (63%)
Go	4,607	0	2,646 (57%)
crates.io	1,475	0	650 (44%)
RubyGems	1,082	0	639 (59%)
NuGet	1,075	0	511 (48%)
Total	34,578	0	18,588 (53.8%)

The field is in use elsewhere

This is not a dead part of the schema. Other databases in the same feeds
populate it:

Source	Records	Using FIX
GO-* (Go vulndb)	4,362	2,300 (52.7%)
PYSEC-* (PyPA)	7,214	2,146 (29.7%)
GHSA-*	34,578	0 (0.0%)

Example

GHSA-35jh-r3h4-6jhm (lodash, CVE-2021-23337) has 17 references. The fix commit
is present, typed WEB:

ADVISORY  https://nvd.nist.gov/vuln/detail/CVE-2021-23337
WEB       https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
WEB       https://www.oracle.com/security-alerts/cpuoct2021.html
WEB       https://snyk.io/vuln/SNYK-JS-LODASH-1040724
PACKAGE   https://github.com/lodash/lodash
...

Why it matters

A consumer wanting the fix commit currently has to pattern-match commit URLs
across GitHub, GitLab and Bitbucket against every reference. That heuristic will
miss self-hosted forges and will occasionally match a link that is not the fix.

This came up while building tooling that uses fix-commit diffs to corroborate
advisory metadata. It is relevant to anything doing patch analysis, reachability
work, or backport detection.

The intent also seems to already be there. In an OpenJS discussion on affected
function naming, a maintainer noted:

For what it's worth we do tend to also provide fix commits when we can find
them which would allow someone to derive the file based location data.

That derivation would be considerably more reliable if the references were
labelled.

Question

Is there a reason FIX is not used, or is it simply not something the curation
workflow currently sets? I have no visibility into how references get typed, so
I may be missing context that makes this a non-issue.

Offer to help

If this is worth addressing and there is a useful way for me to contribute, I am
happy to. I recognise that a change spanning this many advisories is not
something to approach through the one-advisory-per-PR path, and that you likely
have better tooling for it than anything I would write.

So rather than guessing at an approach, I would rather ask: if you want this
fixed, what would actually help? I can share the measurement script, produce a
list of candidate advisories and the reference in each that looks like a fix
commit, or do something else entirely. Guidance welcome.

Reproducing the numbers

curl -O https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip
mkdir feed && unzip -q all.zip -d feed
# count GHSA records, excluding withdrawn, whose references include type FIX

The same holds for every ecosystem archive. Happy to share the full script.