debver

Overview ¶

Package debver compares Debian package version strings.

vexscan does not otherwise order versions: whether a package is affected is OSV's answer, made server-side by /v1/querybatch, so no comparator was ever needed. The fix plan needs one. A package with a dozen advisories, each fixed in a different point release, has one honest remediation -- upgrade to the newest of those versions, which clears them all because distro point releases are cumulative -- and finding "the newest" means comparing them.

The algorithm is dpkg's own (deb-version(7), verrevcmp), reimplemented so a bookworm image's "2.36-9+deb12u7" and "2.36-9+deb12u14" order the way apt would order them. It is deliberately scoped to Debian/Ubuntu versions; other ecosystems have their own rules (a semver pre-release sorts *below* its release, the opposite of a Debian revision) and are compared elsewhere or not at all.