[aliaska-varieva]

Related issue: Resolves #55051

SmartVerCmp broke ties with "the longest wins", so SmartVerCmp("157.0", "157.0.0") == -1. With NVD ranges like versionEndExcluding: 157.0.0, hosts on Firefox 157.0 matched and were reported vulnerable to the MFSA 2026-97 CVEs fixed in 157. At the other end, 154.0 fell below versionStartIncluding: 154.0.0 and missed CVEs.

After the shared parts compare equal, the remaining suffixes are now checked: if both consist only of zero parts ("", 0, 0.0, …) the versions are equal. Any other suffix keeps the existing "longest wins" rule, so 1.0 < 1.0.0.1 and 1.0 < 1.0.0a are unchanged.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

Added TestSmartVerCmp cases for trailing zeros in both directions and for non-zero suffixes. go test ./server/vulnerabilities/nvd/tools/cvefeed/... and go test -tags fts5 ./server/vulnerabilities/nvd/ pass. We found this in our Fleet-based environment, where 157.0 hosts were reporting 36 MFSA 2026-97 CVEs.

Summary by CodeRabbit

• Bug Fixes
  • Corrected vulnerability matching for versions with trailing zero components, reducing false reports for fixed versions and missed matches at the start of affected ranges.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository: fleetdm/fleet/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b361c90f-3530-4a38-a523-0a6da65bdd28

---

📥 Commits

Reviewing files that changed from the base of the PR and between b7dbc54 and 21b2991.

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: fleetdm/fleet/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 61d3553b-3ac1-4191-9fda-b77115327aa4

---

📥 Commits

Reviewing files that changed from the base of the PR and between 18c3a8b and b7dbc54.

---

📒 Files selected for processing (2)

• server/vulnerabilities/nvd/cve_test.go
• server/vulnerabilities/nvd/tools/cvefeed/nvd/match_cpe_test.go

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

---

Walkthrough

SmartVerCmp now treats versions as equal when their remaining components contain only numeric zeroes. Tests cover trailing-zero equality and ordering when a remaining component is nonzero or contains a suffix. Additional tests cover CVE version-range boundaries. The changelog describes the effect of the previous comparison behavior on CVE matching.

Priority: ⬆️ High

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to b7dbc

No actionable merge-blocking issue is identified; merge after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 55.56% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: treating trailing zero version parts as equal in SmartVerCmp.
Description check	✅ Passed	The description identifies the related issue, explains the bug and fix, records automated testing, and includes the required changes file checklist. Manual QA remains unchecked, but the description is…
Linked Issues check	✅ Passed	Issue #55051 requires trailing zero version parts to compare equally and requires non-zero suffix ordering to remain unchanged. SmartVerCmp now treats zero-only remaining suffixes as equal. Tests co…
Out of Scope Changes check	✅ Passed	The changes modify SmartVerCmp, add related automated tests, and add the required changes file. These changes directly support issue #55051. No unrelated changes are identified.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.42%. Comparing base (cf1217b) to head (21b2991).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #55056   +/-   ##
=======================================
  Coverage   74.42%   74.42%           
=======================================
  Files        4297     4297           
  Lines      266321   266329    +8     
  Branches    15641    15641           
=======================================
+ Hits       198209   198215    +6     
- Misses      67932    67933    +1     
- Partials      180      181    +1     

Flag	Coverage Δ
backend	75.21% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Prajwal2246]

Tested this locally. The PR tests pass, and I ran some extra edge cases through SmartVerCmp, all consistent both ways:

• 10.0.19045 == 10.0.19045.0, 1 == 1.0.0.0
• 1.0 == 1.0..0 / 1.0-0 / 1.0_0 / 1.0.
• pre-release suffixes still sort higher like before: 1.0 < 1.0.0-rc1, 157.0 < 157.0.0esr

I also went through the callers (nvd checkVersion, osv analyzer, oval, customcve, winget ingester) and didn't see anything that breaks. "0" vs "" is now 0 instead of 1, but that only matters for a range with no end version, and the result stays "not vulnerable".

One suggestion: there's no test for checkVersion in nvd/cve.go, where the false positive actually showed up. A case with versionEndExcluding: "157.0.0" and host version 157.0 would lock in the real-world fix.

Small nit: the winget ingester sorts version dirs with this, so 1.0 and 1.0.0 would now tie and their order is arbitrary. Probably never happens in practice.

The failing check is test-go-no-db (scripts) being cancelled, which looks unrelated.

[aliaska-varieva]

Thanks for testing this so thoroughly, @Prajwal2246!

Added tests in c78a4bf and b7dbc54:

• TestCheckVersionTrailingZeros (nvd/cve_test.go), as you suggested.
• TestCPEMatchVersionRangeTrailingZeros (cvefeed/nvd/match_cpe_test.go). checkVersion works out the resolved-in version, but the vulnerable/not-vulnerable decision is made in cpeMatch.match. This test runs the real Firefox range (154.0.0 to 157.0.0) against two-part versions: 157.0 no longer matches and 154.0 now does.

Both fail without the fix and pass with it.

On the winget nit: agreed. 1.0 and 1.0.0 are the same version, so tying them seems right.

[juan-fdz-hawa]

Thanks for the contrib.