[BUG] Reporting vulnerability in Nokogiri bump PR despite it bumping to the patched version (v1.18.3)

[larouxn]

Describe the bug

I have a PR that upgrades our application from Nokogiri v1.18.2 to v1.18.3 to address the recent CVE. However, in that PR the dependency review action is reporting v1.18.3 as vulnerable despite it being the patched version. (logs)

GHSA-vvfq-8hwr-qm4m

I suppose this could be some issue with the CVE report on Nokogiri's end but their "v1.18.3 is the patched version" part looks fine and they seem pretty well versed with the CVE system based on their last couple releases.

Expected behavior

No warning as the gem in question is being bumped to the patched version.

Screenshots

Action version

v4.5.0 (latest)

Examples

I don't have any examples but imagine any PR bumping Nokogiri to v1.18.3 will run into this issue.

Additional context

None 🙇‍♂

[indigok]

Thanks for the report! The -gnu was a new suffix we hadn't accounted for before. This is now patched, let us know if the action now runs on your repository 🙇🏻

[rhwood]

I appear to using the most recent published version of dependency-review-action (4.5.0 checksum 3b139cf) but am still encountering this bug. Is that expected?

[larouxn]

This is now patched, let us know if the action now runs on your repository 🙇🏻

Thanks for looking into this! Unfortunately, like @rhwood above, running the action still fails.

[indigok]

Our apologies, we only noticed the reports of -gnu. We should have -musl and all supported platforms covered now 🙇🏻

[larouxn]

Unfortunately already merged our nokogiri bumps so can't test if the fix works or not.

Perhaps you can try and report back @rhwood? 🙏

[rhwood]

Rerunning the checks, and now it is now successfully passing. This appears fixed for me.