unexpected results for a specific commit ID

[Egon Kocjan]

Hi

When running OSV Scanner 2.0.1 on this osv-scanner.json lockfile:

{"results":[{"source":{},"packages":[{"package":{"name":"https://github.com/jquery/jquery-mou...@3.0.6","commit":"a06ef4e1a127795606642c55e22d4f2945edc061"}}]}]}

I get many CVEs for a seemingly unrelated project https://github.com/librenms/librenms, for example https://osv.dev/vulnerability/CVE-2024-47523

Is there any info how vulns are tagged with commit IDs? This one looks like it's not tagged correctly.

Regards

Egon

[Egon Kocjan]

Sorry for spam (I missed github repo), posted issue here instead:

https://github.com/google/osv.dev/issues/3398