[p-linnane]

Vulns::Identify.registry_purl only recognized files.pythonhosted.org resource URLs, but formula revisions from before 2018 download PyPI resources from pypi.python.org. History walks treated those revisions as not shipping the package, so matched advisories started too late. Both hosts use the same packages/<a>/<b>/<hash>/ and packages/source/<letter>/<name>/ layouts, so this accepts either host.

To reproduce, brew advisory-match --json gitup | jq -r '.[] | select(.id == "BREW-gitup-CVE-2026-87817") | .affected[0].ranges[0].events' gives introduced: 0.4.1 on main, which is gitup's first revision on the new host. With this change it gives 0.2.3, the formula's first version, which already bundled GitPython 1.0.1.

Fresh record generation can now fail closed instead of emitting a boundary when older revisions become visible. legit's 0.1.0 label covers both a binary with no declared GitPython resource and a mislabelled 0.2.0 build that declares one, so new legit GitPython candidates report "affected introduction cannot be established" rather than starting at 0.2.1. That is the existing safeguard working as intended. Ordinary ingest preserves existing reviewed introductions, so this neither corrects already-published records nor stops their metadata updates; those need explicit correction.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include brew benchmark results.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• I did not use AI/LLM to create this PR, or I disclosed the tool/model below and reviewed its output; I did not attribute commits to AI and will answer maintainer questions and review comments myself without AI/LLM.

Claude Code found this while independently verifying Homebrew/advisory-database Ingest output against full homebrew-core history, then wrote the change and specs and compared brew advisory-match output for gitup and legit with and without it. I reviewed the diff and the before/after results.

---

[Copilot]

Copilot review overview

🟢 Approval recommended

The change is narrowly scoped and covered by tests; the remaining issue is only a minor nit.

Review effort: Lite
Findings: None

What changed in this PR

Updates vulnerability matching to recognize legacy pypi.python.org resource URLs used by older formula revisions.

Changes:

• Supports both current and legacy PyPI hosts.
• Adds coverage for hashed, source, and wheel URLs.

File	Summary
Library/​Homebrew/​vulns/​identify.rb	Expands PyPI URL matching.
Library/​Homebrew/​test/​vulns/​identify_spec.rb	Tests legacy URL handling.

Review note (nit): Split the legacy-wheel assertion into a separate example.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[dduugg]

Thanks! One small non-blocking edge case inline.