[RyoKusnadi]

Problem

When an OSV record lists versions and also has a range of just {"introduced": "0"}, osvcatalog writes only the listed versions. Any other published version of the package, including one npm has since removed, is not matched. The issue counts 15 of 82 records in one refresh with this shape, all npm.

How it happens: a malicious-package record such as MAL-2026-18437 (atlassian-wallboard-plugin) carries "ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}]}] and "versions": ["10.0.0"] in the same affected entry. OSV defines the affected set as the union of ranges and versions, and introduced: "0" with no fixed already means every version.

Cause

In Convert (internal/osv/osv.go), a.allVersions() was only checked when len(a.Versions) == 0. With a non-empty versions list, the range was never looked at.

Fix

Check a.allVersions() first and emit ["*"] whether or not versions is set. An entry with only a bounded range and no versions is still skipped, as before. I did not change allVersions() itself; it already accepts only introduced: "0" ranges.

Scope

Convert is the only caller of allVersions(). The existing aggregation across several affected entries for one package already let an all-versions entry win; this makes the single-entry case behave the same way.

Testing

Added TestConvertAllVersionsWithListedVersionsInOneEntry in internal/osv/osv_test.go.

• Before the fix it fails: want single [*] entry, got [{ID:MAL-both ... Versions:[10.0.0] ...}].
• After the fix it passes.

Commands run: go vet ./internal/osv/, go test ./internal/osv/ ./tools/..., gofmt -l internal/osv (no output). Not run: the full ./... suite and -race.

Risk

Generated catalogs now contain ["*"] for these packages, so every version of them is flagged. That is what introduced: "0" declares. Regenerating a catalog is the only effect; revert the commit to roll back.

Fixes #90

[RyoKusnadi]

@adel-pplx friendly ping on this one when you have a moment. Happy to change anything.